Package · PyPI

plone-app-theming

3 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Feed

High 8.8

CVE-2020-28736

Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

plone plone-app-event plone-app-dexterity plone-app-theming PyPI

Dec 30, 2020
High 8.8

CVE-2020-28735

SSRF attacks via tracebacks in Plone

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

plone plone-app-event plone-app-dexterity plone-app-theming PyPI

Dec 30, 2020
High 8.8

CVE-2020-28734

Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

plone plone-app-event plone-app-dexterity plone-app-theming PyPI

Dec 30, 2020