CVE-2016-7138: XSS
Published Mar 7, 2017
·Updated
Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Affected Software
59 affected components
pip/plone>=3.3.0<=3.3.6
pip/plone>=4.0.0<=4.3.11
pip/plone>=5.0.0<=5.0.6
Plone plone=3.3
Plone plone=3.3.1
Plone plone=3.3.2
Plone plone=3.3.3
Plone plone=3.3.4
Plone plone=3.3.5
Plone plone=3.3.6
Plone plone=4.0
Plone plone=4.0.1
Plone plone=4.0.2
Plone plone=4.0.3
Plone plone=4.0.4
Plone plone=4.0.5
Plone plone=4.0.7
Plone plone=4.0.8
Plone plone=4.0.9
Plone plone=4.0.10
Plone plone=4.1
Plone plone=4.1.1
Plone plone=4.1.2
Plone plone=4.1.3
Plone plone=4.1.4
Plone plone=4.1.5
Plone plone=4.1.6
Plone plone=4.2
Plone plone=4.2.1
Plone plone=4.2.2
Plone plone=4.2.3
Plone plone=4.2.4
Plone plone=4.2.5
Plone plone=4.2.6
Plone plone=4.2.7
Plone plone=4.3
Plone plone=4.3.1
Plone plone=4.3.2
Plone plone=4.3.3
Plone plone=4.3.4
Plone plone=4.3.5
Plone plone=4.3.6
Plone plone=4.3.7
Plone plone=4.3.8
Plone plone=4.3.9
Plone plone=4.3.10
Plone plone=4.3.11
Plone plone=5.0
Plone plone=5.0-a1
Plone plone=5.0-rc1
Plone plone=5.0-rc2
Plone plone=5.0-rc3
Plone plone=5.0.1
Plone plone=5.0.2
Plone plone=5.0.3
Plone plone=5.0.4
Plone plone=5.0.5
Plone plone=5.0.6
Plone plone=5.1a1
Remediation
Patch Available
Patch Available
Event History
Mar 7, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
May 14, 2022
Advisory Published
02:45 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-7138?
CVE-2016-7138 has a medium severity rating due to its potential impact on user data integrity.
2
How do I fix CVE-2016-7138?
To mitigate CVE-2016-7138, upgrade your Plone CMS to version 5.0.7 or later.
3
Which versions of Plone are affected by CVE-2016-7138?
CVE-2016-7138 affects Plone versions 3.3.x through 3.3.6, 4.x through 4.3.11, and 5.0 through 5.0.6.
4
What type of vulnerability is CVE-2016-7138?
CVE-2016-7138 is a cross-site scripting (XSS) vulnerability.
5
What can attackers do with CVE-2016-7138?
Attackers can exploit CVE-2016-7138 to inject arbitrary web scripts or HTML via crafted URLs.