Plone CVE-2013-4190 Multiple Cross-Site Scripting Vulnerabilities
BID:61953
Info
Plone CVE-2013-4190 Multiple Cross-Site Scripting Vulnerabilities
| Bugtraq ID: | 61953 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-4190 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 31 2013 12:00AM |
| Updated: | Jul 31 2013 12:00AM |
| Credit: | Matthew Wilkes |
| Vulnerable: |
Zope Zope 0 Plone Plone 4.3.1 Plone Plone 4.1.3 Plone Plone 4.0.8 Plone Plone 4.0.7 Plone Plone 3.3.5 Plone Plone 3.3.5 Plone Plone 3.3.4 Plone Plone 3.3.3 Plone Plone 3.3.2 Plone Plone 3.3.1 Plone Plone 3.2.3 Plone Plone 3.2.2 Plone Plone 3.1.6 Plone Plone 3.1.4 Plone Plone 3.0.5 Plone Plone 3.0.4 Plone Plone 3.0.3 Plone Plone 3.0.2 Plone Plone 3.0.1 Plone Plone 2.5.5 Plone Plone 2.5.4 Plone Plone 2.5.1 Plone Plone 2.1.2 Plone Plone 2.0.5 Plone Plone 2.0.4 Plone Plone 4.2a2 Plone Plone 4.2a1 Plone Plone 4.2.5 Plone Plone 4.2.4 Plone Plone 4.2 Plone Plone 4.1 Plone Plone 4.0.9 Plone Plone 4.0.6.1 Plone Plone 4.0.5 Plone Plone 4.0.4 Plone Plone 4.0.3 Plone Plone 4.0.2 Plone Plone 4.0.1 Plone Plone 4.0 Plone Plone 3.3.2 Plone Plone 3.3.1 Plone Plone 3.3 Plone Plone 3.3 Plone Plone 3.2.3 Plone Plone 3.2.2 Plone Plone 3.2.1 Plone Plone 3.2 Plone Plone 3.1.7 Plone Plone 3.1.6 Plone Plone 3.1.5.1 Plone Plone 3.1.3 Plone Plone 3.1.2 Plone Plone 3.1.1 Plone Plone 3.1 Plone Plone 3.0.6 Plone Plone 3.0 Plone Plone 2.5-beta1 Plone Plone 2.5 Plone Plone 2.1.3 Plone Plone 2.1.1 Plone Plone 2.1 Plone Plone 2.0.2 Plone Plone 2.0.1 Plone Plone 2.0 Plone Plone 1.0.6 Plone Plone 1.0.5 Plone Plone 1.0.4 Plone Plone 1.0.3 Plone Plone 1.0.2 Plone Plone 1.0.1 |
| Not Vulnerable: | |
Discussion
Plone CVE-2013-4190 Multiple Cross-Site Scripting Vulnerabilities
Plone is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Note: This issue was previously discussed in BID 61544 (Plone Multiple Remote Security Vulnerabilities) but has been given its own record to better document it.
Plone is prone to multiple cross-site scripting vulnerabilities.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
Note: This issue was previously discussed in BID 61544 (Plone Multiple Remote Security Vulnerabilities) but has been given its own record to better document it.
Exploit / POC
Plone CVE-2013-4190 Multiple Cross-Site Scripting Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
Attackers can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
Plone CVE-2013-4190 Multiple Cross-Site Scripting Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Plone CVE-2013-4190 Multiple Cross-Site Scripting Vulnerabilities
References:
References:
- Bug 978451 - (CVE-2013-4190) CVE-2013-4190 plone: Multiple cross-site scripting (Red Hat Bugzilla)
- CVE Request -- Plone: 20130618 Hotfix (multiple vectors) (Jan Lieskovsky)
- Plone Homepage (Plone)
- Security vulnerability announcement: 20130618 - Multiple vectors (plone)