CVE-2017-1000484

Advisory

Brasil.gov.portal before 1.5.1 uses Plone <4.3.15 which is vulnerable to several XSS and redirect flaws, and a sandbox escape.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

^^^^^^^^^^^^^^^^^^

- Adiciona hotfix de segurança `20171128 <https://plone.org/security/hotfix/20171128>`_.
[hvelarde]

- Atualizado collective.cover à versão 1.6b5;
corrige o crecimento exponencial dos objetos quando se usa versionamento.
[hvelarde]

- Corrige proteção CSRF na adição de sites;
atualiza views e templates de Plone para facilitar manutenção.
[hvelarde]

Resources

• https://pypi.org/project/brasil.gov.portal
• https://pyup.io/changelogs/brasil.gov.portal/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000484
• https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url