CVE-2013-7062: XSS
First published: Thu Jan 02 2020(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/plone | >=4.3<4.3.2 | 4.3.2 |
| pip/plone | >=4.1<4.1.6 | 4.1.6 |
| pip/plone | >=4.0<4.0.9 | 4.0.9 |
| pip/plone | >=3.3<3.3.6 | 3.3.6 |
| Plone CMS | >=3.3.0<=3.3.6 | |
| Plone CMS | >=4.0.0<=4.0.9 | |
| Plone CMS | >=4.1.0<=4.1.6 | |
| Plone CMS | >=4.2.0<=4.2.7 | |
| Plone CMS | >=4.3.0<=4.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2013-7062
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89623
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89627
- https://plone.org/security/20131210/zope-xss-in-OFS
- https://plone.org/security/20131210/zope-xss-in-browseridmanager
- http://seclists.org/oss-sec/2013/q4/467
- http://seclists.org/oss-sec/2013/q4/485
- https://github.com/advisories/GHSA-4793-w44w-m7xm (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-218.yaml
Frequently Asked Questions
What is CVE-2013-7062?
CVE-2013-7062 is a vulnerability that allows remote attackers to inject arbitrary web script or HTML via unspecified input in Zope as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2.
How severe is CVE-2013-7062?
CVE-2013-7062 has a severity rating of 6.1 (medium).
What is the affected software for CVE-2013-7062?
The affected software for CVE-2013-7062 includes Plone versions 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2.
How do I fix CVE-2013-7062?
To fix CVE-2013-7062, it is recommended to upgrade to Plone version 4.3.2, 4.1.6, 4.0.9, or 3.3.6 depending on the affected version.
What is the CWE ID for CVE-2013-7062?
The CWE ID for CVE-2013-7062 is 79.
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/description
- agent/event
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4793-w44w-m7xm
- alias/CVE-2013-7062
- agent/software-canonical-lookup
- agent/references
- agent/last-modified-date
- collector/github-advisory
- agent/trending
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- agent/weakness
- package-manager/pip
- vendor/plone
- canonical/plone cms
- version/plone cms/3.3.0
- version/plone cms/3.3.6
- version/plone cms/4.0.0
- version/plone cms/4.0.9
- version/plone cms/4.1.0
- version/plone cms/4.1.6
- version/plone cms/4.2.0
- version/plone cms/4.2.7
- version/plone cms/4.3.0
- version/plone cms/4.3.2