CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2020-7939
High (8.8) in plone plone. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in plone 5.2.2.
SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
Severity
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 68% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Affected
- plone:plone
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hhmf-7rgg-gcw5 | PyPI | plone | >=4.0 <=5.2.1 | no fix published |
| PYSEC-2020-88 | PyPI | plone | >=4.0 <5.2.2 | 5.2.2 |