Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2017-1000482

A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.

VectorNETWORK

PublishedJan 03, 2018, 18:29

Published Bycve@mitre.org

Base Score

Score5.4

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

Products.CMFPlone(PyPI)04.3.17N/A

Products.CMFPlone(PyPI)5.0.05.0.10N/A

Products.CMFPlone(PyPI)5.1a15.1.0N/A

Plone(PyPI)2.5a14.3.16N/A

Plone(PyPI)5.0a15.1.0N/A

References

https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property

Weakness Type

CWE-79

CVSS Metrics

Base Score

5.4

Vector String

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.0

Attack Vector (AV)

NETWORK