CVE-2015-7316

Advisory

Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.


MLIST:[oss-security] 20150922 Re: CVE Request: Plone XSS: http://www.openwall.com/lists/oss-security/2015/09/22/14
MISC:https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087: https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087
CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1264788: https://bugzilla.redhat.com/show_bug.cgi?id=1264788
CONFIRM:https://plone.org/security/hotfix/20150910/non-persistent-xss-in-plone: https://plone.org/security/hotfix/20150910/non-persistent-xss-in-plone

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7316
• https://plone.org/security/hotfix/20150910/non-persistent-xss-in-plone
• https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087
• https://bugzilla.redhat.com/show_bug.cgi?id=1264788
• http://www.openwall.com/lists/oss-security/2015/09/22/14