CVE-2021-3313 Plone XSS in User Fullname Property and File Upload

What is CVE-2021-3313?

CVE-2021-3313 is a medium-severity cross-site scripting vulnerability in Plone Plone, published on 20 May 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.

Weakness: CWE-79

Which versions are affected by CVE-2021-3313?

3 open source packages ship an affected version, including plone and Plone. It affects 1 product.

Products include Plone Plone.

How do I fix CVE-2021-3313?

Upgrade plone to 5.2.4 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-3313 being exploited?

There is no known exploitation of CVE-2021-3313 in the wild and no public exploit code.

Other vulnerabilities in Plone Plone

• CVE-2021-33509 Incorrect Permission Assignment for Critical Resource in Plone Critical 9.9
• CVE-2020-35190 Hardcoded credentials in n/a Critical 9.8
• CVE-2020-7941 Plone Unauthenticated Write Vulnerability Critical 9.8
• CVE-2011-3587 Zope Command Execution Vulnerability Critical 9.3
• CVE-2021-33926 Server-Side Request Forgery in Plone CMS High 8.8

All Plone Plone vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hprr-4vfq-fcxw, PYSEC-2021-78.