CVE-2021-33926 Server-Side Request Forgery in Plone CMS
Attackers can access sensitive information via the RSS feed portlet in Plone CMS, requiring an upgrade to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-33926?
CVE-2021-33926 is a high-severity server-side request forgery vulnerability in Plone Plone, published on 17 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet.
Weakness: CWE-918
Which versions are affected by CVE-2021-33926?
3 open source packages ship an affected version, including plone and Plone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
plone PyPI | From 4.3 | 5.2.5 |
plone PyPI | From 4.3 | 5.2.5 |
Plone PyPI | From 4.3 | 5.2.5 |
Products include Plone Plone.
How do I fix CVE-2021-33926?
Upgrade plone to 5.2.5 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2021-33926 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-33926 exists.
Other vulnerabilities in Plone Plone
- CVE-2021-33509 Incorrect Permission Assignment for Critical Resource in Plone
- CVE-2020-35190 Hardcoded credentials in n/a
- CVE-2020-7941 Plone Unauthenticated Write Vulnerability
- CVE-2011-3587 Zope Command Execution Vulnerability
- CVE-2020-28734 Improper Restriction of XML External Entity Reference in Plone
Sources
Also known as GHSA-47p5-p3jw-w78w, PYSEC-2023-289.