Executive brief
Plone is an open-source content management system used to publish and manage web content. A reflected cross-site scripting (XSS) vulnerability in multiple Plone components allows attackers to inject malicious scripts that execute in users' browsers when they visit a crafted link, potentially stealing session cookies, redirecting users to phishing sites, or defacing page content.
Technical details
This reflected XSS vulnerability exists in Zope's Products.CMFCore (before 2.5.1) and Products.PluggableAuthService (before 2.6.2) components, which are core parts of the Plone CMS. The vulnerability arises from improper input validation and output encoding in multiple locations within the application. An attacker can craft a malicious URL containing unescaped script payloads and distribute it to users; when a victim visits the link, the script executes in their browser within the context of the vulnerable application. No authentication is required and the attack requires only user interaction (clicking a link). Patches have been released for both affected libraries (CMFCore 2.5.1+ and PluggableAuthService 2.6.2+).
Affected products
- Zope Products.CMFCore before 2.5.1
- Zope Products.PluggableAuthService before 2.6.2
- Plone Plone through 5.2.4
Timeline
- 2021-05-21: disclosed: Published to NVD
- 2021-06-18: advisory: Published to GitHub Advisory Database as GHSA-35rg-466w-77h3
- 2021-05-18: patched: Security hotfix released by Plone project