CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-22889
https://notcve.org/view.php?id=CVE-2024-22889
05 Mar 2024 — Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request. Debido al control de acceso incorrecto en la versión v6.0.9 de Plone, los atacantes remotos pueden ver y enumerar todos los archivos alojados en el sitio web mediante el envío de una solicitud manipulada. • https://github.com/shenhav12/CVE-2024-22889-Plone-v6.0.9 • CWE-276: Incorrect Default Permissions •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-23756
https://notcve.org/view.php?id=CVE-2024-23756
08 Feb 2024 — The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them. Los métodos HTTP PUT y DELETE están habilitados en la versión 5.2.13 (5221) oficial de Docker de Plone, lo que permite a atacantes no autenticados ejecutar acciones peligrosas como cargar archivos al servidor o eliminarlos. • https://github.com/c0d3x27/CVEs/tree/main/CVE-2024-23756 •
CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 1CVE-2024-23054
https://notcve.org/view.php?id=CVE-2024-23054
05 Feb 2024 — An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index (npm). Un problema en el software de código abierto Plone Docker Official Image 5.2.13 (5221) que podría permitir la ejecución remota de código debido a que un paquete listado en ++plone++static/components no existe en el índice de paquetes públicos (npm). • http://plone.com • CWE-427: Uncontrolled Search Path Element •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-23055
https://notcve.org/view.php?id=CVE-2024-23055
25 Jan 2024 — An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST headers. Un problema en el software de código abierto Plone Docker Official Image 5.2.13 (5221) permite la ejecución remota de código mediante una validación incorrecta de la entrada por parte de los encabezados HOST. • http://plone.com •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0669 – Cross-Frame Scripting (XFS) on Plone CMS
https://notcve.org/view.php?id=CVE-2024-0669
18 Jan 2024 — A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element. Se ha encontrado una vulnerabilidad de Cross-Frame Scripting en Plone CMS que afecta a la versión inferior a 6.0.5. Un atacante podría almacenar una URL maliciosa para que la abra un administrador y ejecutar un elemento iframe malicioso. • https://www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-plone-cms • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-42457 – plone.rest vulnerable to Denial of Service when ++api++ is used many times
https://notcve.org/view.php?id=CVE-2023-42457
21 Sep 2023 — plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache). plone.rest p... • http://www.openwall.com/lists/oss-security/2023/09/22/2 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2023-41048 – plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images
https://notcve.org/view.php?id=CVE-2023-41048
21 Sep 2023 — plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when ... • http://www.openwall.com/lists/oss-security/2023/09/22/2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 9.0EPSS: 0%CPEs: 52EXPL: 1CVE-2021-33926
https://notcve.org/view.php?id=CVE-2021-33926
17 Feb 2023 — An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet. • https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 41EXPL: 0CVE-2022-24740 – Improper Authentication in Volto
https://notcve.org/view.php?id=CVE-2022-24740
14 Mar 2022 — Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and privileges. This occurs when using an outdated version of the `react-cookie` library and a server is under high load. A proof of concept does not currently exist, but it is possible for this issue to occur in the wild... • https://github.com/plone/volto/pull/3051 • CWE-287: Improper Authentication •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23599 – Cross-site Scripting and Open Redirect in Products.ATContentTypes
https://notcve.org/view.php?id=CVE-2022-23599
28 Jan 2022 — Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this... • https://github.com/plone/Products.ATContentTypes/commit/fc793f88f35a15a68b52e4abed77af0da5fdbab8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •