id: PYSEC-2017-62
details: Cross-site scripting (XSS) vulnerability in an unspecified page template
  in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows
  remote attackers to inject arbitrary web script or HTML via unknown vectors.
affected:
- package:
    name: plone
    ecosystem: PyPI
    purl: pkg:pypi/plone
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "5.0"
    - fixed: 5.0.7
    - introduced: "4.0"
    - fixed: 4.3.12
    - introduced: "3.3"
    - fixed: 4.0a1
  versions:
  - "3.3"
  - 3.3.1
  - 3.3.2
  - 3.3.3
  - 3.3.4
  - 3.3.5
  - 3.3.6
  - "4.0"
  - 4.0.1
  - 4.0.10
  - 4.0.2
  - 4.0.3
  - 4.0.4
  - 4.0.5
  - 4.0.6
  - 4.0.7
  - 4.0.8
  - 4.0.9
  - "4.1"
  - 4.1.1
  - 4.1.2
  - 4.1.3
  - 4.1.4
  - 4.1.5
  - 4.1.6
  - 4.1a1
  - 4.1a2
  - 4.1a3
  - 4.1b1
  - 4.1b2
  - 4.1rc2
  - 4.1rc3
  - "4.2"
  - 4.2.1
  - 4.2.2
  - 4.2.3
  - 4.2.4
  - 4.2.5
  - 4.2.6
  - 4.2.7
  - 4.2a1
  - 4.2a2
  - 4.2b1
  - 4.2b2
  - 4.2rc1
  - 4.2rc2
  - "4.3"
  - 4.3.1
  - 4.3.10
  - 4.3.11
  - 4.3.2
  - 4.3.3
  - 4.3.4
  - 4.3.5
  - 4.3.6
  - 4.3.7
  - 4.3.8
  - 4.3.9
  - 4.3a1
  - 4.3a2
  - 4.3b1
  - 4.3b2
  - 4.3rc1
  - "5.0"
  - 5.0.1
  - 5.0.2
  - 5.0.3
  - 5.0.4
  - 5.0.5
  - 5.0.6
references:
- type: WEB
  url: https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2016/09/05/5
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2016/09/05/4
- type: WEB
  url: http://seclists.org/fulldisclosure/2016/Oct/80
- type: WEB
  url: 
    http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html
- type: WEB
  url: http://www.securityfocus.com/bid/92752
- type: WEB
  url: http://www.securityfocus.com/archive/1/539572/100/0/threaded
- type: ADVISORY
  url: https://github.com/advisories/GHSA-pp4c-2692-7f37
aliases:
- CVE-2016-7139
- GHSA-pp4c-2692-7f37
modified: "2021-07-25T23:34:49.468488Z"
published: "2017-03-07T16:59:00Z"