CVE-2017-1000482

A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:*
cpe:2.3:a:plone:plone:5.1:a1:*:*:*:*:*:*
cpe:2.3:a:plone:plone:5.1:a2:*:*:*:*:*:*
cpe:2.3:a:plone:plone:5.1:b2:*:*:*:*:*:*
cpe:2.3:a:plone:plone:5.1:b3:*:*:*:*:*:*
cpe:2.3:a:plone:plone:5.1:b4:*:*:*:*:*:*
cpe:2.3:a:plone:plone:5.1:rc1:*:*:*:*:*:*

History

No history.

Information

Published : 2018-01-03 18:29

Updated : 2024-02-04 19:29


NVD link : CVE-2017-1000482

Mitre link : CVE-2017-1000482

CVE.ORG link : CVE-2017-1000482


JSON object : View

Products Affected

plone

  • plone
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')