Description
Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to Members/ipa/createObject.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | plone | < 2.5.3 | 2.5.3 | GHSA-cvwc-g7fw-7xrj |
References
- http://dev.plone.org/plone/ticket/6110
- JVNDB-2011-000056 third-party-advisory
- JVN#41222793 third-party-advisory
- http://dev.plone.org/plone/changeset/12262