CVE-2017-1000482

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1

Description The issue allows a member of the Plone site to set JavaScript in the home page property of their profile. This JavaScript is executed when a visitor clicks the home page link on the author page.

Recommendations For Plone versions 2.5 through 5.1rc1, consider disabling the ability to set JavaScript in the home page property of user profiles until a fix is available. Restrict access to the author page to minimize the risk of exploitation. Avoid using the home page property in user profiles until the issue is resolved.