CVE-2016-7140 Plone vulnerable to Cross-site Scripting
MediumCVSS 6.1
EPSS 1.6%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi plone(PyPI) | >= 5.0a1, < 5.0.7 | 5.0.7 |
| pypi plone(PyPI) | = 5.0 | No fix listed |
| pypi plone(PyPI) | = 5.0.1 | No fix listed |
| pypi plone(PyPI) | = 5.0.2 | No fix listed |
| pypi plone(PyPI) | = 5.0.3 | No fix listed |
| pypi plone(PyPI) | = 5.0.4 | No fix listed |
| pypi plone(PyPI) | = 5.0.5 | No fix listed |
| pypi plone(PyPI) | = 5.0.6 | No fix listed |
| pypi plone(PyPI) | = 5.0a1 | No fix listed |
| pypi plone(PyPI) | = 5.0a2 | No fix listed |
| pypi plone(PyPI) | = 5.0a3 | No fix listed |
| pypi plone(PyPI) | = 5.0b1 | No fix listed |
| pypi plone(PyPI) | = 5.0b2 | No fix listed |
| pypi plone(PyPI) | = 5.0b3 | No fix listed |
| pypi plone(PyPI) | = 5.0b4 | No fix listed |
| pypi plone(PyPI) | = 5.0rc1 | No fix listed |
| pypi plone(PyPI) | = 5.0rc2 | No fix listed |
| pypi plone(PyPI) | = 5.0rc3 | No fix listed |
| pypi plone(PyPI) | >= 3.3a1, < 4.3.12 | 4.3.12 |
| pypi plone(PyPI) | = 3.3 | No fix listed |
| pypi plone(PyPI) | = 3.3.1 | No fix listed |
| pypi plone(PyPI) | = 3.3.2 | No fix listed |
| pypi plone(PyPI) | = 3.3.3 | No fix listed |
| pypi plone(PyPI) | = 3.3.4 | No fix listed |
| pypi plone(PyPI) | = 3.3.5 | No fix listed |
Show 133 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi plone(PyPI) | = 3.3.6 | No fix listed |
| pypi plone(PyPI) | = 3.3b1 | No fix listed |
| pypi plone(PyPI) | = 3.3rc1 | No fix listed |
| pypi plone(PyPI) | = 3.3rc2 | No fix listed |
| pypi plone(PyPI) | = 3.3rc3 | No fix listed |
| pypi plone(PyPI) | = 3.3rc4 | No fix listed |
| pypi plone(PyPI) | = 3.3rc5 | No fix listed |
| pypi plone(PyPI) | = 4.0 | No fix listed |
| pypi plone(PyPI) | = 4.0.1 | No fix listed |
| pypi plone(PyPI) | = 4.0.10 | No fix listed |
| pypi plone(PyPI) | = 4.0.2 | No fix listed |
| pypi plone(PyPI) | = 4.0.3 | No fix listed |
| pypi plone(PyPI) | = 4.0.4 | No fix listed |
| pypi plone(PyPI) | = 4.0.5 | No fix listed |
| pypi plone(PyPI) | = 4.0.6 | No fix listed |
| pypi plone(PyPI) | = 4.0.7 | No fix listed |
| pypi plone(PyPI) | = 4.0.8 | No fix listed |
| pypi plone(PyPI) | = 4.0.9 | No fix listed |
| pypi plone(PyPI) | = 4.0a1 | No fix listed |
| pypi plone(PyPI) | = 4.0a2 | No fix listed |
| pypi plone(PyPI) | = 4.0a3 | No fix listed |
| pypi plone(PyPI) | = 4.0a4 | No fix listed |
| pypi plone(PyPI) | = 4.0a5 | No fix listed |
| pypi plone(PyPI) | = 4.0b1 | No fix listed |
| pypi plone(PyPI) | = 4.0b2 | No fix listed |
| pypi plone(PyPI) | = 4.0b3 | No fix listed |
| pypi plone(PyPI) | = 4.0b4 | No fix listed |
| pypi plone(PyPI) | = 4.0b5 | No fix listed |
| pypi plone(PyPI) | = 4.0rc1 | No fix listed |
| pypi plone(PyPI) | = 4.1 | No fix listed |
| pypi plone(PyPI) | = 4.1.1 | No fix listed |
| pypi plone(PyPI) | = 4.1.2 | No fix listed |
| pypi plone(PyPI) | = 4.1.3 | No fix listed |
| pypi plone(PyPI) | = 4.1.4 | No fix listed |
| pypi plone(PyPI) | = 4.1.5 | No fix listed |
| pypi plone(PyPI) | = 4.1.6 | No fix listed |
| pypi plone(PyPI) | = 4.1a1 | No fix listed |
| pypi plone(PyPI) | = 4.1a2 | No fix listed |
| pypi plone(PyPI) | = 4.1a3 | No fix listed |
| pypi plone(PyPI) | = 4.1b1 | No fix listed |
| pypi plone(PyPI) | = 4.1b2 | No fix listed |
| pypi plone(PyPI) | = 4.1rc2 | No fix listed |
| pypi plone(PyPI) | = 4.1rc3 | No fix listed |
| pypi plone(PyPI) | = 4.2 | No fix listed |
| pypi plone(PyPI) | = 4.2.1 | No fix listed |
| pypi plone(PyPI) | = 4.2.2 | No fix listed |
| pypi plone(PyPI) | = 4.2.3 | No fix listed |
| pypi plone(PyPI) | = 4.2.4 | No fix listed |
| pypi plone(PyPI) | = 4.2.5 | No fix listed |
| pypi plone(PyPI) | = 4.2.6 | No fix listed |
| pypi plone(PyPI) | = 4.2.7 | No fix listed |
| pypi plone(PyPI) | = 4.2a1 | No fix listed |
| pypi plone(PyPI) | = 4.2a2 | No fix listed |
| pypi plone(PyPI) | = 4.2b1 | No fix listed |
| pypi plone(PyPI) | = 4.2b2 | No fix listed |
| pypi plone(PyPI) | = 4.2rc1 | No fix listed |
| pypi plone(PyPI) | = 4.2rc2 | No fix listed |
| pypi plone(PyPI) | = 4.3 | No fix listed |
| pypi plone(PyPI) | = 4.3.1 | No fix listed |
| pypi plone(PyPI) | = 4.3.10 | No fix listed |
| pypi plone(PyPI) | = 4.3.11 | No fix listed |
| pypi plone(PyPI) | = 4.3.2 | No fix listed |
| pypi plone(PyPI) | = 4.3.3 | No fix listed |
| pypi plone(PyPI) | = 4.3.4 | No fix listed |
| pypi plone(PyPI) | = 4.3.5 | No fix listed |
| pypi plone(PyPI) | = 4.3.6 | No fix listed |
| pypi plone(PyPI) | = 4.3.7 | No fix listed |
| pypi plone(PyPI) | = 4.3.8 | No fix listed |
| pypi plone(PyPI) | = 4.3.9 | No fix listed |
| pypi plone(PyPI) | = 4.3a1 | No fix listed |
| pypi plone(PyPI) | = 4.3a2 | No fix listed |
| pypi plone(PyPI) | = 4.3b1 | No fix listed |
| pypi plone(PyPI) | = 4.3b2 | No fix listed |
| pypi plone(PyPI) | = 4.3rc1 | No fix listed |
| pypi plone(PyPI) | >= 5.0, < 5.0.7 | 5.0.7 |
| pypi plone(PyPI) | >= 4.0, < 4.3.12 | 4.3.12 |
| pypi plone(PyPI) | >= 3.3, < 4.0a1 | 4.0a1 |
| plone | = 3.3 | No fix listed |
| plone | = 3.3.1 | No fix listed |
| plone | = 3.3.2 | No fix listed |
| plone | = 3.3.3 | No fix listed |
| plone | = 3.3.4 | No fix listed |
| plone | = 3.3.5 | No fix listed |
| plone | = 3.3.6 | No fix listed |
| plone | = 4.0 | No fix listed |
| plone | = 4.0.1 | No fix listed |
| plone | = 4.0.2 | No fix listed |
| plone | = 4.0.3 | No fix listed |
| plone | = 4.0.4 | No fix listed |
| plone | = 4.0.5 | No fix listed |
| plone | = 4.0.7 | No fix listed |
| plone | = 4.0.8 | No fix listed |
| plone | = 4.0.9 | No fix listed |
| plone | = 4.0.10 | No fix listed |
| plone | = 4.1 | No fix listed |
| plone | = 4.1.1 | No fix listed |
| plone | = 4.1.2 | No fix listed |
| plone | = 4.1.3 | No fix listed |
| plone | = 4.1.4 | No fix listed |
| plone | = 4.1.5 | No fix listed |
| plone | = 4.1.6 | No fix listed |
| plone | = 4.2 | No fix listed |
| plone | = 4.2.1 | No fix listed |
| plone | = 4.2.2 | No fix listed |
| plone | = 4.2.3 | No fix listed |
| plone | = 4.2.4 | No fix listed |
| plone | = 4.2.5 | No fix listed |
| plone | = 4.2.6 | No fix listed |
| plone | = 4.2.7 | No fix listed |
| plone | = 4.3 | No fix listed |
| plone | = 4.3.1 | No fix listed |
| plone | = 4.3.2 | No fix listed |
| plone | = 4.3.3 | No fix listed |
| plone | = 4.3.4 | No fix listed |
| plone | = 4.3.5 | No fix listed |
| plone | = 4.3.6 | No fix listed |
| plone | = 4.3.7 | No fix listed |
| plone | = 4.3.8 | No fix listed |
| plone | = 4.3.9 | No fix listed |
| plone | = 4.3.10 | No fix listed |
| plone | = 4.3.11 | No fix listed |
| plone | = 5.0 | No fix listed |
| plone | = 5.0-a1 | No fix listed |
| plone | = 5.0-rc1 | No fix listed |
| plone | = 5.0-rc2 | No fix listed |
| plone | = 5.0-rc3 | No fix listed |
| plone | = 5.0.1 | No fix listed |
| plone | = 5.0.2 | No fix listed |
| plone | = 5.0.3 | No fix listed |
| plone | = 5.0.4 | No fix listed |
| plone | = 5.0.5 | No fix listed |
| plone | = 5.0.6 | No fix listed |
| plone | = 5.1a1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com product
- github.com
- plone.org vendor-advisory
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20161019 Multiple Vulnerabilities in Plone CMS mailing-list third-party-advisory vdb-entry
- [oss-security] 20160905 Re: CVE request: Plone multiple vulnerabilities mailing-list patch third-party-advisory
- [oss-security] 20160905 Re: CVE request: Plone multiple vulnerabilities mailing-list patch third-party-advisory
- 92752 vdb-entry
- 20161012 Multiple Vulnerabilities in Plone CMS mailing-list
- github.com vendor-advisory