{"api_version":"1","generated_at":"2026-07-23T06:14:33+00:00","cve":"CVE-2008-4571","urls":{"html":"https://cve.report/CVE-2008-4571","api":"https://cve.report/api/cve/CVE-2008-4571.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2008-4571","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2008-4571"},"summary":{"title":"CVE-2008-4571","description":"Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag.","state":"PUBLISHED","assigner":"mitre","published_at":"2008-10-15 20:00:03","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://dev.plone.org/plone/ticket/7439","name":"http://dev.plone.org/plone/ticket/7439","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"#7439 (Possible XSS into  LiveSearch module)\n     – Plone development workspace","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://plone.org/products/plone/releases/3.0.4","name":"http://plone.org/products/plone/releases/3.0.4","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Plone 3.0.4\n            —\n        \n        Plone CMS: Open Source Content Management","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/27098","name":"http://www.securityfocus.com/bid/27098","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"Plone 'LiveSearch' Module HTML Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://secunia.com/advisories/28293","name":"http://secunia.com/advisories/28293","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Plone LiveSearch Module News Item Script Insertion - Secunia Advisories - Vulnerability Intelligence - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/40660","name":"http://osvdb.org/40660","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2008-4571","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4571","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2008","cve_id":"4571","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"plone","cpe5":"plone","cpe6":"2.0.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4571","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"plone","cpe5":"plone","cpe6":"2.1.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4571","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"plone","cpe5":"plone","cpe6":"2.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4571","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"plone","cpe5":"plone","cpe6":"2.5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4571","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"plone","cpe5":"plone","cpe6":"2.5.1_rc","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4571","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"plone","cpe5":"plone","cpe6":"2.5.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4571","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"plone","cpe5":"plone","cpe6":"2.5_beta1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4571","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"plone","cpe5":"plone","cpe6":"3.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4571","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"plone","cpe5":"plone","cpe6":"3.0.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4571","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"plone","cpe5":"plone","cpe6":"3.0.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2008","cve_id":"4571","vulnerable":"1","versionEndIncluding":"3.0.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"plone","cpe5":"plone","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2008-4571","qid":"997204","title":"Python (Pip) Security Update for Plone (GHSA-46f9-f8jm-mw2x)"}]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T10:24:19.347Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"27098","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/27098"},{"name":"28293","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/28293"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://plone.org/products/plone/releases/3.0.4"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://dev.plone.org/plone/ticket/7439"},{"name":"40660","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/40660"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2008-01-02T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2008-11-15T10:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"27098","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/27098"},{"name":"28293","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/28293"},{"tags":["x_refsource_CONFIRM"],"url":"http://plone.org/products/plone/releases/3.0.4"},{"tags":["x_refsource_CONFIRM"],"url":"http://dev.plone.org/plone/ticket/7439"},{"name":"40660","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/40660"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2008-4571","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"27098","refsource":"BID","url":"http://www.securityfocus.com/bid/27098"},{"name":"28293","refsource":"SECUNIA","url":"http://secunia.com/advisories/28293"},{"name":"http://plone.org/products/plone/releases/3.0.4","refsource":"CONFIRM","url":"http://plone.org/products/plone/releases/3.0.4"},{"name":"http://dev.plone.org/plone/ticket/7439","refsource":"CONFIRM","url":"http://dev.plone.org/plone/ticket/7439"},{"name":"40660","refsource":"OSVDB","url":"http://osvdb.org/40660"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2008-4571","datePublished":"2008-10-15T18:12:00.000Z","dateReserved":"2008-10-15T00:00:00.000Z","dateUpdated":"2024-08-07T10:24:19.347Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2008-10-15 20:00:03","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:*","versionEndIncluding":"3.0.3","matchCriteriaId":"C047BD17-7523-4751-9331-EED767783308"},{"vulnerable":true,"criteria":"cpe:2.3:a:plone:plone:2.0.5:*:*:*:*:*:*:*","matchCriteriaId":"67D4EB7F-BC46-4F2E-B065-303961C47B1E"},{"vulnerable":true,"criteria":"cpe:2.3:a:plone:plone:2.1.2:*:*:*:*:*:*:*","matchCriteriaId":"78755057-2613-4D5E-8F59-2C117EE282B6"},{"vulnerable":true,"criteria":"cpe:2.3:a:plone:plone:2.5:*:*:*:*:*:*:*","matchCriteriaId":"9762C674-380B-4831-BBA1-3B27742121B0"},{"vulnerable":true,"criteria":"cpe:2.3:a:plone:plone:2.5.1:*:*:*:*:*:*:*","matchCriteriaId":"3D938645-80CE-4287-830E-A3BD0C5C84FB"},{"vulnerable":true,"criteria":"cpe:2.3:a:plone:plone:2.5.1_rc:*:*:*:*:*:*:*","matchCriteriaId":"C01E0884-D0A4-4511-AD4B-DBB09CB8080E"},{"vulnerable":true,"criteria":"cpe:2.3:a:plone:plone:2.5.4:*:*:*:*:*:*:*","matchCriteriaId":"7B60568E-A688-46AF-B627-062A029A7324"},{"vulnerable":true,"criteria":"cpe:2.3:a:plone:plone:2.5_beta1:*:*:*:*:*:*:*","matchCriteriaId":"C577B46C-7692-4B6F-B487-A28F73D403F1"},{"vulnerable":true,"criteria":"cpe:2.3:a:plone:plone:3.0:*:*:*:*:*:*:*","matchCriteriaId":"0B647E76-E8B8-4329-8848-3B90EB262807"},{"vulnerable":true,"criteria":"cpe:2.3:a:plone:plone:3.0.1:*:*:*:*:*:*:*","matchCriteriaId":"0D0A6B8F-4018-44DC-9862-45309619DC6D"},{"vulnerable":true,"criteria":"cpe:2.3:a:plone:plone:3.0.2:*:*:*:*:*:*:*","matchCriteriaId":"0F10374F-2BB3-48D2-B19F-9B2D038A8E35"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2008","CveId":"4571","Ordinal":"1","Title":"CVE-2008-4571","CVE":"CVE-2008-4571","Year":"2008"},"notes":[{"CveYear":"2008","CveId":"4571","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag.","Type":"Description","Title":"CVE-2008-4571"},{"CveYear":"2008","CveId":"4571","Ordinal":"2","NoteData":"2008-10-15","Type":"Other","Title":"Published"},{"CveYear":"2008","CveId":"4571","Ordinal":"3","NoteData":"2008-11-15","Type":"Other","Title":"Modified"}]}}}