Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2020-7937

An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site.

VectorNETWORK

PublishedJan 23, 2020, 21:15

Published Bycve@mitre.org

Base Score

Score5.4

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

Plone(PyPI)5.0N/AN/A

References

http://www.openwall.com/lists/oss-security/2020/01/24/1
https://plone.org/security/hotfix/20200121
https://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher
https://www.openwall.com/lists/oss-security/2020/01/22/1

Weakness Type

CWE-79

CVSS Metrics

Base Score

5.4

Vector String

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK