Executive brief
Plone is a content management system used to build and maintain websites and intranets. An XSS vulnerability in Plone's python_scripts.py allows remote attackers to inject malicious scripts into pages, potentially allowing them to steal administrator credentials, deface content, or compromise user sessions. The attack requires minimal technical skill and no authentication.
Technical details
A cross-site scripting (CWE-79) vulnerability exists in python_scripts.py in Plone before version 4.2.3 and 4.3 beta 1, related to improper handling of the "translate" parameter. The vulnerability allows remote attackers to inject arbitrary JavaScript or HTML through unspecified vectors without authentication. An attacker can exploit this by sending a crafted request to an affected Plone instance, causing malicious code to be executed in the browsers of site visitors. The fix was released in Plone 4.2.3 and 4.3 beta 1.
Affected products
- Plone Plone 3.0 through 4.2.2, and 4.3a1 through 4.3a2
Timeline
- 2012-11-06: disclosed
- 2012-11-06: patched: Fixed in Plone 4.2.3 and 4.3 beta 1