id: PYSEC-2017-61
details: Cross-site scripting (XSS) vulnerability in the URL checking infrastructure
  in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows
  remote attackers to inject arbitrary web script or HTML via a crafted URL.
affected:
- package:
    name: plone
    ecosystem: PyPI
    purl: pkg:pypi/plone
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "5.0"
    - fixed: 5.0.7
    - introduced: "4.0"
    - fixed: 4.3.12
    - introduced: "3.3"
    - fixed: 4.0a1
  versions:
  - "3.3"
  - 3.3.1
  - 3.3.2
  - 3.3.3
  - 3.3.4
  - 3.3.5
  - 3.3.6
  - "4.0"
  - 4.0.1
  - 4.0.10
  - 4.0.2
  - 4.0.3
  - 4.0.4
  - 4.0.5
  - 4.0.6
  - 4.0.7
  - 4.0.8
  - 4.0.9
  - "4.1"
  - 4.1.1
  - 4.1.2
  - 4.1.3
  - 4.1.4
  - 4.1.5
  - 4.1.6
  - 4.1a1
  - 4.1a2
  - 4.1a3
  - 4.1b1
  - 4.1b2
  - 4.1rc2
  - 4.1rc3
  - "4.2"
  - 4.2.1
  - 4.2.2
  - 4.2.3
  - 4.2.4
  - 4.2.5
  - 4.2.6
  - 4.2.7
  - 4.2a1
  - 4.2a2
  - 4.2b1
  - 4.2b2
  - 4.2rc1
  - 4.2rc2
  - "4.3"
  - 4.3.1
  - 4.3.10
  - 4.3.11
  - 4.3.2
  - 4.3.3
  - 4.3.4
  - 4.3.5
  - 4.3.6
  - 4.3.7
  - 4.3.8
  - 4.3.9
  - 4.3a1
  - 4.3a2
  - 4.3b1
  - 4.3b2
  - 4.3rc1
  - "5.0"
  - 5.0.1
  - 5.0.2
  - 5.0.3
  - 5.0.4
  - 5.0.5
  - 5.0.6
references:
- type: WEB
  url: https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone-1
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2016/09/05/5
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2016/09/05/4
- type: WEB
  url: http://seclists.org/fulldisclosure/2016/Oct/80
- type: WEB
  url: 
    http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html
- type: WEB
  url: http://www.securityfocus.com/bid/92752
- type: WEB
  url: http://www.securityfocus.com/archive/1/539572/100/0/threaded
- type: ADVISORY
  url: https://github.com/advisories/GHSA-v3hp-f8qr-cf3p
aliases:
- CVE-2016-7138
- GHSA-v3hp-f8qr-cf3p
modified: "2021-07-25T23:34:49.134095Z"
published: "2017-03-07T16:59:00Z"