CVE-2021-33513

Advisory

Products.cmfdifftool 3.3.3 includes a fix for a XSS vulnerability.
https://plone.org/security/hotfix/20210518/xss-vulnerability-in-cmfdifftool

Affected package

Affected versions

Fixed versions

Vulnerability changelog

------------------

Bug fixes:


- Added XSS fix from PloneHotfix20210518 for inline diff.
See `vulnerability <https://plone.org/security/hotfix/20210518/xss-vulnerability-in-cmfdifftool>`_.
The first version of the hotfix escaped all html.
Now for the rich text field, use the safe html transform, otherwise the inline diff is no longer inline.
[maurits] (39)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33513
• https://plone.org/security/hotfix/20210518/xss-vulnerability-in-cmfdifftool
• http://www.openwall.com/lists/oss-security/2021/05/22/1