CVE-2022-23599 Cross-site Scripting and Open Redirect in Products.ATContentTypes
Attackers can inject scripts or redirect users via cache poisoning in Plone's image view, affecting visitors with cached pages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2022-23599?
CVE-2022-23599 is a medium-severity cross-site scripting vulnerability in Plone Plone, published on 28 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user's cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.
Which versions are affected by CVE-2022-23599?
3 open source packages ship an affected version, including products-atcontenttypes and Products.ATContentTypes. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
products-atcontenttypes PyPI | All versions | 3.0.6 |
products-atcontenttypes PyPI | All versions | 3.0.6 |
Products.ATContentTypes PyPI | All versions | 3.0.6 |
Products include Plone Plone.
How do I fix CVE-2022-23599?
Upgrade products-atcontenttypes to 3.0.6 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-23599 being exploited?
There is no known exploitation of CVE-2022-23599 in the wild and no public exploit code.
Other vulnerabilities in Plone Plone
Sources
Also known as GHSA-g4c2-ghfg-g5rh, PYSEC-2022-21.