CVE-2016-7139 Plone Cross-site Scripting (XSS) vulnerability
MediumCVSS 6.1
EPSS 1.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi plone(PyPI) | >= 5.0, < 5.0.6 | 5.0.6 |
| pypi plone(PyPI) | = 5.0 | No fix listed |
| pypi plone(PyPI) | = 5.0.1 | No fix listed |
| pypi plone(PyPI) | = 5.0.2 | No fix listed |
| pypi plone(PyPI) | = 5.0.3 | No fix listed |
| pypi plone(PyPI) | = 5.0.4 | No fix listed |
| pypi plone(PyPI) | = 5.0.5 | No fix listed |
| pypi plone(PyPI) | >= 4.0a1, < 4.3.12 | 4.3.12 |
| pypi plone(PyPI) | = 4.0 | No fix listed |
| pypi plone(PyPI) | = 4.0.1 | No fix listed |
| pypi plone(PyPI) | = 4.0.10 | No fix listed |
| pypi plone(PyPI) | = 4.0.2 | No fix listed |
| pypi plone(PyPI) | = 4.0.3 | No fix listed |
| pypi plone(PyPI) | = 4.0.4 | No fix listed |
| pypi plone(PyPI) | = 4.0.5 | No fix listed |
| pypi plone(PyPI) | = 4.0.6 | No fix listed |
| pypi plone(PyPI) | = 4.0.7 | No fix listed |
| pypi plone(PyPI) | = 4.0.8 | No fix listed |
| pypi plone(PyPI) | = 4.0.9 | No fix listed |
| pypi plone(PyPI) | = 4.0a1 | No fix listed |
| pypi plone(PyPI) | = 4.0a2 | No fix listed |
| pypi plone(PyPI) | = 4.0a3 | No fix listed |
| pypi plone(PyPI) | = 4.0a4 | No fix listed |
| pypi plone(PyPI) | = 4.0a5 | No fix listed |
| pypi plone(PyPI) | = 4.0b1 | No fix listed |
Show 118 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi plone(PyPI) | = 4.0b2 | No fix listed |
| pypi plone(PyPI) | = 4.0b3 | No fix listed |
| pypi plone(PyPI) | = 4.0b4 | No fix listed |
| pypi plone(PyPI) | = 4.0b5 | No fix listed |
| pypi plone(PyPI) | = 4.0rc1 | No fix listed |
| pypi plone(PyPI) | = 4.1 | No fix listed |
| pypi plone(PyPI) | = 4.1.1 | No fix listed |
| pypi plone(PyPI) | = 4.1.2 | No fix listed |
| pypi plone(PyPI) | = 4.1.3 | No fix listed |
| pypi plone(PyPI) | = 4.1.4 | No fix listed |
| pypi plone(PyPI) | = 4.1.5 | No fix listed |
| pypi plone(PyPI) | = 4.1.6 | No fix listed |
| pypi plone(PyPI) | = 4.1a1 | No fix listed |
| pypi plone(PyPI) | = 4.1a2 | No fix listed |
| pypi plone(PyPI) | = 4.1a3 | No fix listed |
| pypi plone(PyPI) | = 4.1b1 | No fix listed |
| pypi plone(PyPI) | = 4.1b2 | No fix listed |
| pypi plone(PyPI) | = 4.1rc2 | No fix listed |
| pypi plone(PyPI) | = 4.1rc3 | No fix listed |
| pypi plone(PyPI) | = 4.2 | No fix listed |
| pypi plone(PyPI) | = 4.2.1 | No fix listed |
| pypi plone(PyPI) | = 4.2.2 | No fix listed |
| pypi plone(PyPI) | = 4.2.3 | No fix listed |
| pypi plone(PyPI) | = 4.2.4 | No fix listed |
| pypi plone(PyPI) | = 4.2.5 | No fix listed |
| pypi plone(PyPI) | = 4.2.6 | No fix listed |
| pypi plone(PyPI) | = 4.2.7 | No fix listed |
| pypi plone(PyPI) | = 4.2a1 | No fix listed |
| pypi plone(PyPI) | = 4.2a2 | No fix listed |
| pypi plone(PyPI) | = 4.2b1 | No fix listed |
| pypi plone(PyPI) | = 4.2b2 | No fix listed |
| pypi plone(PyPI) | = 4.2rc1 | No fix listed |
| pypi plone(PyPI) | = 4.2rc2 | No fix listed |
| pypi plone(PyPI) | = 4.3 | No fix listed |
| pypi plone(PyPI) | = 4.3.1 | No fix listed |
| pypi plone(PyPI) | = 4.3.10 | No fix listed |
| pypi plone(PyPI) | = 4.3.11 | No fix listed |
| pypi plone(PyPI) | = 4.3.2 | No fix listed |
| pypi plone(PyPI) | = 4.3.3 | No fix listed |
| pypi plone(PyPI) | = 4.3.4 | No fix listed |
| pypi plone(PyPI) | = 4.3.5 | No fix listed |
| pypi plone(PyPI) | = 4.3.6 | No fix listed |
| pypi plone(PyPI) | = 4.3.7 | No fix listed |
| pypi plone(PyPI) | = 4.3.8 | No fix listed |
| pypi plone(PyPI) | = 4.3.9 | No fix listed |
| pypi plone(PyPI) | = 4.3a1 | No fix listed |
| pypi plone(PyPI) | = 4.3a2 | No fix listed |
| pypi plone(PyPI) | = 4.3b1 | No fix listed |
| pypi plone(PyPI) | = 4.3b2 | No fix listed |
| pypi plone(PyPI) | = 4.3rc1 | No fix listed |
| pypi plone(PyPI) | >= 3.3, <= 3.3.6 | No fix listed |
| pypi plone(PyPI) | = 3.3 | No fix listed |
| pypi plone(PyPI) | = 3.3.1 | No fix listed |
| pypi plone(PyPI) | = 3.3.2 | No fix listed |
| pypi plone(PyPI) | = 3.3.3 | No fix listed |
| pypi plone(PyPI) | = 3.3.4 | No fix listed |
| pypi plone(PyPI) | = 3.3.5 | No fix listed |
| pypi plone(PyPI) | = 3.3.6 | No fix listed |
| pypi plone(PyPI) | >= 5.0, < 5.0.7 | 5.0.7 |
| pypi plone(PyPI) | >= 4.0, < 4.3.12 | 4.3.12 |
| pypi plone(PyPI) | >= 3.3, < 4.0a1 | 4.0a1 |
| pypi plone(PyPI) | = 5.0.6 | No fix listed |
| plone | = 3.3 | No fix listed |
| plone | = 3.3.1 | No fix listed |
| plone | = 3.3.2 | No fix listed |
| plone | = 3.3.3 | No fix listed |
| plone | = 3.3.4 | No fix listed |
| plone | = 3.3.5 | No fix listed |
| plone | = 3.3.6 | No fix listed |
| plone | = 4.0 | No fix listed |
| plone | = 4.0.1 | No fix listed |
| plone | = 4.0.2 | No fix listed |
| plone | = 4.0.3 | No fix listed |
| plone | = 4.0.4 | No fix listed |
| plone | = 4.0.5 | No fix listed |
| plone | = 4.0.7 | No fix listed |
| plone | = 4.0.8 | No fix listed |
| plone | = 4.0.9 | No fix listed |
| plone | = 4.0.10 | No fix listed |
| plone | = 4.1 | No fix listed |
| plone | = 4.1.1 | No fix listed |
| plone | = 4.1.2 | No fix listed |
| plone | = 4.1.3 | No fix listed |
| plone | = 4.1.4 | No fix listed |
| plone | = 4.1.5 | No fix listed |
| plone | = 4.1.6 | No fix listed |
| plone | = 4.2 | No fix listed |
| plone | = 4.2.1 | No fix listed |
| plone | = 4.2.2 | No fix listed |
| plone | = 4.2.3 | No fix listed |
| plone | = 4.2.4 | No fix listed |
| plone | = 4.2.5 | No fix listed |
| plone | = 4.2.6 | No fix listed |
| plone | = 4.2.7 | No fix listed |
| plone | = 4.3 | No fix listed |
| plone | = 4.3.1 | No fix listed |
| plone | = 4.3.2 | No fix listed |
| plone | = 4.3.3 | No fix listed |
| plone | = 4.3.4 | No fix listed |
| plone | = 4.3.5 | No fix listed |
| plone | = 4.3.6 | No fix listed |
| plone | = 4.3.7 | No fix listed |
| plone | = 4.3.8 | No fix listed |
| plone | = 4.3.9 | No fix listed |
| plone | = 4.3.10 | No fix listed |
| plone | = 4.3.11 | No fix listed |
| plone | = 5.0 | No fix listed |
| plone | = 5.0-a1 | No fix listed |
| plone | = 5.0-rc1 | No fix listed |
| plone | = 5.0-rc2 | No fix listed |
| plone | = 5.0-rc3 | No fix listed |
| plone | = 5.0.1 | No fix listed |
| plone | = 5.0.2 | No fix listed |
| plone | = 5.0.3 | No fix listed |
| plone | = 5.0.4 | No fix listed |
| plone | = 5.0.5 | No fix listed |
| plone | = 5.0.6 | No fix listed |
| plone | = 5.1a1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com
- plone.org vendor-advisory
- web.archive.org
- web.archive.org
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20161019 Multiple Vulnerabilities in Plone CMS mailing-list third-party-advisory vdb-entry
- [oss-security] 20160905 Re: CVE request: Plone multiple vulnerabilities mailing-list patch third-party-advisory
- [oss-security] 20160905 Re: CVE request: Plone multiple vulnerabilities mailing-list patch third-party-advisory
- 20161012 Multiple Vulnerabilities in Plone CMS mailing-list
- 92752 vdb-entry
- github.com vendor-advisory