medium
6.1
CWE
601 79
Advisory Published
Advisory Published
Updated

CVE-2022-23599: Cross-site Scripting and Open Redirect in Products.ATContentTypes

First published: Fri Jan 28 2022(Updated: )

### Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on your cache settings. ### Patches A new version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2 (Python 2 only) and will be included in Plone 5.2.7. Note that the Products.CMFPlone package has the same problem in the 4.3 series. `plone.app.contenttypes` has the same problem in all versions, see [advisory](https://github.com/plone/plone.app.contenttypes/security/advisories/GHSA-f7qw-5fgj-247x). For all unpatched versions of the three packages, you can use the following workaround. ### Workaround Make sure the image_view_fullscreen page is not stored in the cache. In Plone: * Login as Manager and go to Site Setup. * Go to the 'Caching' control panel. If this does not exist, or 'Enable caching' is not checked, you should normally not be vulnerable. * Click on the tab 'Caching operations'. * Under 'Legacy template mappings' locate the ruleset 'Content item view'. * From the last column ('Templates') remove 'image_view_fullscreen'. * Click on Save. ### Reporter This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Secure Consulting. Thank you! ### For more information If you have any questions or comments about this advisory, email us at [security@plone.org](mailto:security@plone.org) This is also the correct address to use when you want to report a possible vulnerability. See [our security report policy](https://plone.org/security/report).

Credit: security-advisories@github.com security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
Plone Plone<3.0.6
pip/Products.ATContentTypes<3.0.6
3.0.6

Remedy

https://github.com/plone/Products.ATContentTypes/commit/fc793f88f35a15a68b52e4abed77af0da5fdbab8

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is CVE-2022-23599?

    CVE-2022-23599 is a vulnerability in Products.ATContentTypes, the core content types for Plone 2.1 - 4.3.

  • What is the severity of CVE-2022-23599?

    CVE-2022-23599 has a severity rating of medium (6.1).

  • Which versions of Plone are affected by CVE-2022-23599?

    Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are affected by CVE-2022-23599.

  • What is the vulnerability type of CVE-2022-23599?

    CVE-2022-23599 is a vulnerability that includes reflected cross site scripting and open redirect.

  • How can I fix CVE-2022-23599?

    To fix CVE-2022-23599, you need to update Products.ATContentTypes to version 3.0.6 or higher.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203