CVE-2016-7140: XSS
Published Mar 7, 2017
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Affected Software
58 affected componentsFixes available
pip/Plone>=3.3a1<4.3.12
4.3.12
pip/Plone>=5.0a1<5.0.7
5.0.7
Plone plone=3.3
Plone plone=3.3.1
Plone plone=3.3.2
Plone plone=3.3.3
Plone plone=3.3.4
Plone plone=3.3.5
Plone plone=3.3.6
Plone plone=4.0
Plone plone=4.0.1
Plone plone=4.0.2
Plone plone=4.0.3
Plone plone=4.0.4
Plone plone=4.0.5
Plone plone=4.0.7
Plone plone=4.0.8
Plone plone=4.0.9
Plone plone=4.0.10
Plone plone=4.1
Plone plone=4.1.1
Plone plone=4.1.2
Plone plone=4.1.3
Plone plone=4.1.4
Plone plone=4.1.5
Plone plone=4.1.6
Plone plone=4.2
Plone plone=4.2.1
Plone plone=4.2.2
Plone plone=4.2.3
Plone plone=4.2.4
Plone plone=4.2.5
Plone plone=4.2.6
Plone plone=4.2.7
Plone plone=4.3
Plone plone=4.3.1
Plone plone=4.3.2
Plone plone=4.3.3
Plone plone=4.3.4
Plone plone=4.3.5
Plone plone=4.3.6
Plone plone=4.3.7
Plone plone=4.3.8
Plone plone=4.3.9
Plone plone=4.3.10
Plone plone=4.3.11
Plone plone=5.0
Plone plone=5.0-a1
Plone plone=5.0-rc1
Plone plone=5.0-rc2
Plone plone=5.0-rc3
Plone plone=5.0.1
Plone plone=5.0.2
Plone plone=5.0.3
Plone plone=5.0.4
Plone plone=5.0.5
Plone plone=5.0.6
Plone plone=5.1a1
Remediation
Patch Available
Patch Available
Event History
Mar 7, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
May 14, 2022
Advisory Published
via GitHub·02:45 AM
Frequently Asked Questions
1
What is the severity of CVE-2016-7140?
CVE-2016-7140 is classified as a medium severity vulnerability due to its potential impact on web applications.
2
How do I fix CVE-2016-7140?
To fix CVE-2016-7140, upgrade your Plone CMS to version 4.3.12 or 5.0.7 or later.
3
What types of vulnerabilities does CVE-2016-7140 include?
CVE-2016-7140 includes multiple cross-site scripting (XSS) vulnerabilities.
4
Which versions of Plone are affected by CVE-2016-7140?
CVE-2016-7140 affects Plone CMS versions 3.3 through 5.0.6.
5
Can CVE-2016-7140 be exploited remotely?
Yes, CVE-2016-7140 can be exploited remotely by attackers to inject arbitrary web scripts or HTML.