CVE-2015-7316: XSS
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
Other sources
Plone's URL checking infrastructure includes a method for checking if URLs valid and located in the Plone site. By passing HTML into a specially crafted url containing <script, %3Cscript, javascript:, or javascript%3A, Cross-site Scripting can be achieved.
— GitHub
Plone's URL checking infrastructure includes a method for checking if URLs valid and located in the Plone site. By passing HTML into this specially crafted url, XSS can be achieved. Versions affected are Plone 3.x, 4.1.x, 4.2.x, <4.3.7, <5.0rc1.
Upstream patch:
https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087
CVE request:
http://seclists.org/oss-sec/2015/q3/587
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7316?
The severity of CVE-2015-7316 is classified as medium-level due to its cross-site scripting (XSS) nature.
How do I fix CVE-2015-7316?
To fix CVE-2015-7316, upgrade to Plone versions 3.3.7, 4.0.11, 4.1.7, 4.2.8, 4.3.7, or later.
What versions of Plone are affected by CVE-2015-7316?
CVE-2015-7316 affects Plone versions from 3.3.0 to 3.3.6, 4.0.0 to 4.0.10, 4.1.0 to 4.1.6, 4.2.0 to 4.2.7, and 4.3.x before 4.3.7.
What type of vulnerability is CVE-2015-7316?
CVE-2015-7316 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts.
Are there any known exploits for CVE-2015-7316?
While specific exploits for CVE-2015-7316 have not been publicly documented, the nature of XSS vulnerabilities makes them a significant risk if left unaddressed.