CVE-2011-1949: XSS

Q: What is the severity of CVE-2011-1949?

CVE-2011-1949 is categorized as a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2011-1949?

To mitigate CVE-2011-1949, upgrade Plone to version 4.1.1 or apply the appropriate patch for your version.

Q: What versions of Plone are affected by CVE-2011-1949?

CVE-2011-1949 affects Plone versions 2.1 through 4.1, including several specific versions like 3.3, 4.0.5, and others.

Q: Who can exploit CVE-2011-1949?

CVE-2011-1949 can be exploited by remote authenticated users due to insufficient validation of user input.

Q: What are the potential impacts of CVE-2011-1949?

Exploiting CVE-2011-1949 can allow attackers to execute arbitrary web scripts or HTML within the context of the user’s browser.

Published Jun 6, 2011

Updated

Cross-site scripting (XSS) vulnerability in the safehtml filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-2422.

Affected Software

47 affected componentsFixes available

pip/Plone>=4.1a0<4.1.1

4.1.1

pip/Plone>=4.0a0<4.0.6

4.0.6

pip/Plone>=3.3.2<3.3.6

3.3.6

Plone plone=2.1

Plone plone=2.1.1

Plone plone=2.1.2

Plone plone=2.1.3

Plone plone=2.1.4

Plone plone=2.5

Plone plone=2.5.1

Plone plone=2.5.2

Plone plone=2.5.3

Plone plone=2.5.4

Plone plone=2.5.5

Plone plone=3.0

Plone plone=3.0.1

Plone plone=3.0.2

Plone plone=3.0.3

Plone plone=3.0.4

Plone plone=3.0.5

Plone plone=3.0.6

Plone plone=3.1

Plone plone=3.1.1

Plone plone=3.1.2

Plone plone=3.1.3

Plone plone=3.1.4

Plone plone=3.1.5.1

Plone plone=3.1.6

Plone plone=3.1.7

Plone plone=3.2

Plone plone=3.2.1

Plone plone=3.2.2

Plone plone=3.2.3

Plone plone=3.3

Plone plone=3.3.1

Plone plone=3.3.2

Plone plone=3.3.3

Plone plone=3.3.4

Plone plone=3.3.5

Plone plone=4.0

Plone plone=4.0.1

Plone plone=4.0.2

Plone plone=4.0.3

Plone plone=4.0.4

Plone plone=4.0.5

Plone plone=4.0.6.1

Plone plone=4.1

Remediation

Patch Available

http://plone.org/products/plone/security/advisories/CVE-2011-1949

Event History

Jun 6, 2011

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Jul 23, 2018

Advisory Published

via GitHub·09:01 PM

Frequently Asked Questions

What is the severity of CVE-2011-1949?

CVE-2011-1949 is categorized as a moderate severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2011-1949?