CVE-2016-7138 Plone XSS
MediumCVSS 6.1
EPSS 1.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi plone(PyPI) | >= 5.0.0, <= 5.0.6 | No fix listed |
| pypi plone(PyPI) | = 5.0 | No fix listed |
| pypi plone(PyPI) | = 5.0.1 | No fix listed |
| pypi plone(PyPI) | = 5.0.2 | No fix listed |
| pypi plone(PyPI) | = 5.0.3 | No fix listed |
| pypi plone(PyPI) | = 5.0.4 | No fix listed |
| pypi plone(PyPI) | = 5.0.5 | No fix listed |
| pypi plone(PyPI) | = 5.0.6 | No fix listed |
| pypi plone(PyPI) | >= 4.0.0, <= 4.3.11 | No fix listed |
| pypi plone(PyPI) | = 4.0 | No fix listed |
| pypi plone(PyPI) | = 4.0.1 | No fix listed |
| pypi plone(PyPI) | = 4.0.10 | No fix listed |
| pypi plone(PyPI) | = 4.0.2 | No fix listed |
| pypi plone(PyPI) | = 4.0.3 | No fix listed |
| pypi plone(PyPI) | = 4.0.4 | No fix listed |
| pypi plone(PyPI) | = 4.0.5 | No fix listed |
| pypi plone(PyPI) | = 4.0.6 | No fix listed |
| pypi plone(PyPI) | = 4.0.7 | No fix listed |
| pypi plone(PyPI) | = 4.0.8 | No fix listed |
| pypi plone(PyPI) | = 4.0.9 | No fix listed |
| pypi plone(PyPI) | = 4.1 | No fix listed |
| pypi plone(PyPI) | = 4.1.1 | No fix listed |
| pypi plone(PyPI) | = 4.1.2 | No fix listed |
| pypi plone(PyPI) | = 4.1.3 | No fix listed |
| pypi plone(PyPI) | = 4.1.4 | No fix listed |
Show 107 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi plone(PyPI) | = 4.1.5 | No fix listed |
| pypi plone(PyPI) | = 4.1.6 | No fix listed |
| pypi plone(PyPI) | = 4.1a1 | No fix listed |
| pypi plone(PyPI) | = 4.1a2 | No fix listed |
| pypi plone(PyPI) | = 4.1a3 | No fix listed |
| pypi plone(PyPI) | = 4.1b1 | No fix listed |
| pypi plone(PyPI) | = 4.1b2 | No fix listed |
| pypi plone(PyPI) | = 4.1rc2 | No fix listed |
| pypi plone(PyPI) | = 4.1rc3 | No fix listed |
| pypi plone(PyPI) | = 4.2 | No fix listed |
| pypi plone(PyPI) | = 4.2.1 | No fix listed |
| pypi plone(PyPI) | = 4.2.2 | No fix listed |
| pypi plone(PyPI) | = 4.2.3 | No fix listed |
| pypi plone(PyPI) | = 4.2.4 | No fix listed |
| pypi plone(PyPI) | = 4.2.5 | No fix listed |
| pypi plone(PyPI) | = 4.2.6 | No fix listed |
| pypi plone(PyPI) | = 4.2.7 | No fix listed |
| pypi plone(PyPI) | = 4.2a1 | No fix listed |
| pypi plone(PyPI) | = 4.2a2 | No fix listed |
| pypi plone(PyPI) | = 4.2b1 | No fix listed |
| pypi plone(PyPI) | = 4.2b2 | No fix listed |
| pypi plone(PyPI) | = 4.2rc1 | No fix listed |
| pypi plone(PyPI) | = 4.2rc2 | No fix listed |
| pypi plone(PyPI) | = 4.3 | No fix listed |
| pypi plone(PyPI) | = 4.3.1 | No fix listed |
| pypi plone(PyPI) | = 4.3.10 | No fix listed |
| pypi plone(PyPI) | = 4.3.11 | No fix listed |
| pypi plone(PyPI) | = 4.3.2 | No fix listed |
| pypi plone(PyPI) | = 4.3.3 | No fix listed |
| pypi plone(PyPI) | = 4.3.4 | No fix listed |
| pypi plone(PyPI) | = 4.3.5 | No fix listed |
| pypi plone(PyPI) | = 4.3.6 | No fix listed |
| pypi plone(PyPI) | = 4.3.7 | No fix listed |
| pypi plone(PyPI) | = 4.3.8 | No fix listed |
| pypi plone(PyPI) | = 4.3.9 | No fix listed |
| pypi plone(PyPI) | = 4.3a1 | No fix listed |
| pypi plone(PyPI) | = 4.3a2 | No fix listed |
| pypi plone(PyPI) | = 4.3b1 | No fix listed |
| pypi plone(PyPI) | = 4.3b2 | No fix listed |
| pypi plone(PyPI) | = 4.3rc1 | No fix listed |
| pypi plone(PyPI) | >= 3.3.0, <= 3.3.6 | No fix listed |
| pypi plone(PyPI) | = 3.3 | No fix listed |
| pypi plone(PyPI) | = 3.3.1 | No fix listed |
| pypi plone(PyPI) | = 3.3.2 | No fix listed |
| pypi plone(PyPI) | = 3.3.3 | No fix listed |
| pypi plone(PyPI) | = 3.3.4 | No fix listed |
| pypi plone(PyPI) | = 3.3.5 | No fix listed |
| pypi plone(PyPI) | = 3.3.6 | No fix listed |
| pypi plone(PyPI) | >= 5.0, < 5.0.7 | 5.0.7 |
| pypi plone(PyPI) | >= 4.0, < 4.3.12 | 4.3.12 |
| pypi plone(PyPI) | >= 3.3, < 4.0a1 | 4.0a1 |
| plone | = 3.3 | No fix listed |
| plone | = 3.3.1 | No fix listed |
| plone | = 3.3.2 | No fix listed |
| plone | = 3.3.3 | No fix listed |
| plone | = 3.3.4 | No fix listed |
| plone | = 3.3.5 | No fix listed |
| plone | = 3.3.6 | No fix listed |
| plone | = 4.0 | No fix listed |
| plone | = 4.0.1 | No fix listed |
| plone | = 4.0.2 | No fix listed |
| plone | = 4.0.3 | No fix listed |
| plone | = 4.0.4 | No fix listed |
| plone | = 4.0.5 | No fix listed |
| plone | = 4.0.7 | No fix listed |
| plone | = 4.0.8 | No fix listed |
| plone | = 4.0.9 | No fix listed |
| plone | = 4.0.10 | No fix listed |
| plone | = 4.1 | No fix listed |
| plone | = 4.1.1 | No fix listed |
| plone | = 4.1.2 | No fix listed |
| plone | = 4.1.3 | No fix listed |
| plone | = 4.1.4 | No fix listed |
| plone | = 4.1.5 | No fix listed |
| plone | = 4.1.6 | No fix listed |
| plone | = 4.2 | No fix listed |
| plone | = 4.2.1 | No fix listed |
| plone | = 4.2.2 | No fix listed |
| plone | = 4.2.3 | No fix listed |
| plone | = 4.2.4 | No fix listed |
| plone | = 4.2.5 | No fix listed |
| plone | = 4.2.6 | No fix listed |
| plone | = 4.2.7 | No fix listed |
| plone | = 4.3 | No fix listed |
| plone | = 4.3.1 | No fix listed |
| plone | = 4.3.2 | No fix listed |
| plone | = 4.3.3 | No fix listed |
| plone | = 4.3.4 | No fix listed |
| plone | = 4.3.5 | No fix listed |
| plone | = 4.3.6 | No fix listed |
| plone | = 4.3.7 | No fix listed |
| plone | = 4.3.8 | No fix listed |
| plone | = 4.3.9 | No fix listed |
| plone | = 4.3.10 | No fix listed |
| plone | = 4.3.11 | No fix listed |
| plone | = 5.0 | No fix listed |
| plone | = 5.0-a1 | No fix listed |
| plone | = 5.0-rc1 | No fix listed |
| plone | = 5.0-rc2 | No fix listed |
| plone | = 5.0-rc3 | No fix listed |
| plone | = 5.0.1 | No fix listed |
| plone | = 5.0.2 | No fix listed |
| plone | = 5.0.3 | No fix listed |
| plone | = 5.0.4 | No fix listed |
| plone | = 5.0.5 | No fix listed |
| plone | = 5.0.6 | No fix listed |
| plone | = 5.1a1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com
- plone.org vendor-advisory
- web.archive.org
- web.archive.org
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20161019 Multiple Vulnerabilities in Plone CMS mailing-list third-party-advisory vdb-entry
- [oss-security] 20160905 Re: CVE request: Plone multiple vulnerabilities mailing-list patch third-party-advisory
- [oss-security] 20160905 Re: CVE request: Plone multiple vulnerabilities mailing-list patch third-party-advisory
- 20161012 Multiple Vulnerabilities in Plone CMS mailing-list
- 92752 vdb-entry
- github.com vendor-advisory