CVE-2021-3313

MEDIUM

Plone < 5.2.4 - Stored Cross-Site Scripting via User Fullname and File Upload

Title source: llm
STIX 2.1

Description

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.

References (4)

Core 4
Core References
Release Notes, Vendor Advisory x_refsource_misc
https://plone.org/download/releases/5.2.3
Vendor Advisory x_refsource_misc
https://plone.org/security/hotfix/20210518
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2021/05/22/1

Scores

CVSS v3 5.4
EPSS 0.0097
EPSS Percentile 58.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
plone/plone < 5.2.4
pypi/Plone 0 - 5.2.4PyPI
Published May 20, 2021
Tracked Since Feb 18, 2026