CVE-2021-33507

Advisory

Plone.namedfile 5.5.0 prevents stored XSS from file upload (svg, html) by implementing an allowlist of trusted mimetypes.
https://github.com/plone/plone.namedfile/commit/37b9b7f29b0f804df622db9502abae28f3eccf38
https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots

Affected package

Affected versions

Fixed versions

Vulnerability changelog

------------------

New features:


- Prevent stored XSS from file upload (svg, html).
Do this by implementing an allowlist of trusted mimetypes.
You can turn this around by using a denylist of just svg, html and javascript.
Do this by setting OS environment variable ``NAMEDFILE_USE_DENYLIST=1``.
From `Products.PloneHotfix20210518 <https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots>`_.
[maurits] (3274)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33507
• https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots
• http://www.openwall.com/lists/oss-security/2021/05/22/1