Plone Multiple Security Vulnerabilities
BID:48005
Info
Plone Multiple Security Vulnerabilities
| Bugtraq ID: | 48005 |
| Class: | Unknown |
| CVE: |
CVE-2011-1948 CVE-2011-1949 CVE-2011-1950 |
| Remote: | Yes |
| Local: | No |
| Published: | May 26 2011 12:00AM |
| Updated: | Mar 08 2012 12:30PM |
| Credit: | Matthew |
| Vulnerable: |
RedHat Enterprise Linux Clustering 5 server Plone Plone 3.3.5 Plone Plone 3.3.4 Plone Plone 3.3.3 Plone Plone 3.3.2 Plone Plone 3.3.1 Plone Plone 3.2.3 Plone Plone 3.2.2 Plone Plone 3.1.6 Plone Plone 3.0.4 Plone Plone 3.0.3 Plone Plone 3.0.2 Plone Plone 3.0.1 Plone Plone 2.5.4 Plone Plone 2.5.1 Plone Plone 2.1.2 Plone Plone 2.0.5 Plone Plone 2.0.4 Plone Plone 4.0 Plone Plone 3.3 Plone Plone 3.2 Plone Plone 3.1 Plone Plone 3.0 Plone Plone 2.5-beta1 Plone Plone 2.5 Oracle Enterprise Linux 5 |
| Not Vulnerable: | |
Discussion
Plone Multiple Security Vulnerabilities
Plone is prone to multiple security vulnerabilities, including a security-bypass issue, a cross-site scripting issue and HTML-injection issue.
Attackers can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site or to perform restricted actions. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user.
Plone is prone to multiple security vulnerabilities, including a security-bypass issue, a cross-site scripting issue and HTML-injection issue.
Attackers can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site or to perform restricted actions. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user.
Exploit / POC
Plone Multiple Security Vulnerabilities
Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user into following a malicious URI.
Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, the attacker must entice an unsuspecting user into following a malicious URI.
Solution / Fix
Plone Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Plone Multiple Security Vulnerabilities
References:
References:
- Plone Homepage (Plone)
- [CVE-REQUEST] Plone XSS and permission errors (matthe)