CVSS 3.0
5.4 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NCVE-2017-1000482
A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- plone:plone
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-859j-668v-mrr6 | PyPI | products-cmfplone | <4.3.17 | 4.3.17 |
| GHSA-859j-668v-mrr6 | PyPI | products-cmfplone | >=5.0.0 <5.0.10 | 5.0.10 |
| GHSA-859j-668v-mrr6 | PyPI | products-cmfplone | >=5.1a1 <5.1.0 | 5.1.0 |
| GHSA-859j-668v-mrr6 | PyPI | plone | >=2.5a1 <4.3.16 | 4.3.16 |
| GHSA-859j-668v-mrr6 | PyPI | plone | >=5.0a1 <5.1.0 | 5.1.0 |
| PYSEC-2018-71 | PyPI | plone | >=2.5 <4.3.16 >=5 <5.1.0 | 4.3.16, 5.1.0 |
| PYSEC-2026-2962 | PyPI | products-cmfplone | <4.3.17 >=5.0.0 <5.0.10 >=5.1a1 <5.1.0 | 4.3.17, 5.0.10, 5.1.0 |