CVE-2021-33507: XSS
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-33507?
CVE-2021-33507 is a vulnerability that allows Reflected XSS in Zope Products.CMFCore and Products.PluggableAuthService, as used in Plone through version 5.2.4 and other products.
How severe is CVE-2021-33507?
CVE-2021-33507 has a severity rating of 6.1, which is considered medium.
What software versions are affected by CVE-2021-33507?
Plone versions up to 4.3.20 and versions between 5.0 and 5.2.4, as well as Zope versions up to 2.5.1 are affected by CVE-2021-33507.
What is the Common Weakness Enumeration (CWE) ID for CVE-2021-33507?
CVE-2021-33507 is associated with CWE-79, which is the category for Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
How can I fix CVE-2021-33507?
To fix CVE-2021-33507, update Zope Products.CMFCore to version 2.5.1 or later, and update Products.PluggableAuthService to version 2.6.2 or later.