CVE-2015-7316 Plone Cross-site Scripting Vulnerability
An attacker can inject malicious scripts into Plone CMS pages, potentially stealing user sessions or executing code in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2015-7316?
CVE-2015-7316 is a medium-severity cross-site scripting vulnerability in Plone Plone, published on 25 Sep 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.
Weakness: CWE-79
Which versions are affected by CVE-2015-7316?
13 open source packages ship an affected version, including plone and Plone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
plone PyPI | All versions | None |
plone PyPI | From 3.3 | 4.0a1, 4.1a1, 4.2a1, 4.3a1, 4.3.7, 5.0rc2 |
plone PyPI | From 3.3 | 3.3.7 |
plone PyPI | From 4.0 | 4.0.11 |
plone PyPI | From 4.1 | 4.1.7 |
plone PyPI | From 4.2 | 4.2.8 |
7 more packages
plone PyPI | From 4.3 | 4.3.7 |
Plone PyPI | All versions | None |
Plone PyPI | From 3.3 | 3.3.7 |
Plone PyPI | From 4.0 | 4.0.11 |
Plone PyPI | From 4.1 | 4.1.7 |
Plone PyPI | From 4.2 | 4.2.8 |
Plone PyPI | From 4.3 | 4.3.7 |
Products include Plone Plone.
How do I fix CVE-2015-7316?
Upgrade plone to a fixed version for your release line: 4.0a1, 4.1a1, 4.2a1 or 4.3a1.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2015-7316 being exploited?
There is no known exploitation of CVE-2015-7316 in the wild and no public exploit code.
Other vulnerabilities in Plone Plone
Sources
Also known as GHSA-vf8g-m3vq-6p4p, PYSEC-2017-53.