CVE-2020-28736

Published: Dec 30, 2020Modified: Nov 21, 2024

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

Affected (1)

Products: Plone: Plone

Plone

1 product

Plone

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Plone Plone	Before 5.2.3

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (6)

https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt

Source: cve@mitre.org

Release NotesVendor Advisory

https://github.com/plone/Products.CMFPlone/issues/3209

Source: cve@mitre.org

PatchThird Party Advisory

https://www.misakikata.com/codes/plone/python-en.html

Source: cve@mitre.org

Broken Link

https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://github.com/plone/Products.CMFPlone/issues/3209

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.misakikata.com/codes/plone/python-en.html

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

Timeline

No history available yet.