CVE-2021-33926: SSRF
Published Feb 17, 2023
·Updated
An issue in Plone CMS allows attacker to access sensitive information via the RSS feed protlet.
Other sources
An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet.
Affected Software
53 affected componentsFixes available
pip/Plone>=4.3<5.2.5
5.2.5
Plone plone=4.3
Plone plone=4.3.1
Plone plone=4.3.2
Plone plone=4.3.3
Plone plone=4.3.4
Plone plone=4.3.5
Plone plone=4.3.6
Plone plone=4.3.7
Plone plone=4.3.8
Plone plone=4.3.9
Plone plone=4.3.10
Plone plone=4.3.11
Plone plone=4.3.12
Plone plone=4.3.14
Plone plone=4.3.15
Plone plone=4.3.17
Plone plone=4.3.18
Plone plone=4.3.19
Plone plone=4.3.20
Plone plone=5.0
Plone plone=5.0-rc1
Plone plone=5.0-rc2
Plone plone=5.0-rc3
Plone plone=5.0.1
Plone plone=5.0.2
Plone plone=5.0.3
Plone plone=5.0.4
Plone plone=5.0.5
Plone plone=5.0.6
Plone plone=5.0.7
Plone plone=5.0.8
Plone plone=5.0.9
Plone plone=5.0.10
Plone plone=5.1-alpha2
Plone plone=5.1.1
Plone plone=5.1.2
Plone plone=5.1.4
Plone plone=5.1.5
Plone plone=5.1.6
Plone plone=5.1.7
Plone plone=5.1a1-alpha1
Plone plone=5.1a2-beta4
Plone plone=5.1b2-beta3
Plone plone=5.1b3-beta2
Plone plone=5.1b4-rc2
Plone plone=5.1rc1-rc1
Plone plone=5.1rc2
Plone plone=5.2.0
Plone plone=5.2.1
Plone plone=5.2.2
Plone plone=5.2.3
Plone plone=5.2.4
Event History
Feb 17, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·06:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:30 PM
Frequently Asked Questions
1
How can I determine if my Plone CMS is vulnerable to CVE-2021-33926?
You can determine vulnerability by checking if your Plone CMS version is 5.2.4 or earlier and comparing it against the official security release notes.