PT-2021-18016

CVE-2021-29002

Published

2021-03-24

Updated

2022-05-24

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Plone CMS version 5.2.3

Description: A stored cross-site scripting (XSS) issue exists in the site-controlpanel via the form.widgets.site title parameter. This allows for potential malicious script execution.

Recommendations: For Plone CMS version 5.2.3, consider restricting access to the site-controlpanel until a patch is available. As a temporary workaround, avoid using the form.widgets.site title parameter in the affected site-controlpanel to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2021-29002

GHSA-38G6-X6JV-JWFF