affected:
- package:
    ecosystem: PyPI
    name: plone
    purl: pkg:pypi/plone
  ranges:
  - events:
    - introduced: '4.3'
    - fixed: 5.2.5
    type: ECOSYSTEM
  versions:
  - '4.3'
  - 4.3.1
  - 4.3.10
  - 4.3.11
  - 4.3.12
  - 4.3.13
  - 4.3.14
  - 4.3.15
  - 4.3.16
  - 4.3.17
  - 4.3.18
  - 4.3.19
  - 4.3.2
  - 4.3.20
  - 4.3.3
  - 4.3.4
  - 4.3.5
  - 4.3.6
  - 4.3.7
  - 4.3.8
  - 4.3.9
  - '5.0'
  - 5.0.1
  - 5.0.10
  - 5.0.2
  - 5.0.3
  - 5.0.4
  - 5.0.5
  - 5.0.6
  - 5.0.7
  - 5.0.8
  - 5.0.9
  - 5.0a1
  - 5.0a2
  - 5.0a3
  - 5.0b1
  - 5.0b2
  - 5.0b3
  - 5.0b4
  - 5.0rc1
  - 5.0rc2
  - 5.0rc3
  - 5.1.0
  - 5.1.1
  - 5.1.2
  - 5.1.3
  - 5.1.4
  - 5.1.5
  - 5.1.6
  - 5.1.7
  - 5.1a1
  - 5.1a2
  - 5.1b1
  - 5.1b2
  - 5.1b3
  - 5.1b4
  - 5.1rc1
  - 5.1rc2
  - 5.2.0
  - 5.2.1
  - 5.2.2
  - 5.2.3
  - 5.2.4
  - 5.2a1
  - 5.2a2
  - 5.2b1
  - 5.2rc1
  - 5.2rc2
  - 5.2rc3
  - 5.2rc4
  - 5.2rc5
aliases:
- CVE-2021-33926
- GHSA-47p5-p3jw-w78w
details: An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1,
  5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1,
  5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2,
  5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows
  attacker to access sensitive information via the RSS feed protlet.
id: PYSEC-2023-289
modified: '2024-11-25T18:35:18.357593Z'
published: '2023-02-17T18:15:00Z'
references:
- type: EVIDENCE
  url: https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf
- type: WEB
  url: https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf
- type: ADVISORY
  url: https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-url
- type: WEB
  url: https://plone.org/security/hotfix/20210518
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  type: CVSS_V3