Quick answers
- Is CVE-2021-29002 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-29002 being exploited in the wild.
- How severe is CVE-2021-29002?
- Low severity, with a CVSS score of 3.1, published 24 March 2021.
- Which products and versions are affected?
- Plone 3.0 through 5.2.3; plone (PyPI) ECOSYSTEM:introduced=0,last_affected=5.2.3.
- Is there a fix for CVE-2021-29002?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2021-29002 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2021-29002?
- Check whether you run Plone or plone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the site control panel of Plone CMS, specifically in the form.widgets.site_title parameter used to set the site title. The vulnerability stems from insufficient output encoding/sanitization of the site title value when it is rendered on pages. An authenticated user with manager privileges can inject arbitrary JavaScript code through the Site Setup interface, which is then persistently stored and executed in the browsers of all users viewing the affected site. An attacker must have valid admin credentials to exploit this vulnerability. The injected payload persists and executes each time the site title is displayed, making it a high-impact stored XSS attack.
Affected products
- Plone Plone 3.0 through 5.2.3
Identifiers
- CVE-2021-29002
- GHSA-38g6-x6jv-jwff
- PYSEC-2021-889
Timeline
- 2021-03-24: disclosed
- 2022-05-24: advisory