Description
Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Cluster 5 | luci +2 | 0.12.2-51.el5 | RHSA-2012:0151 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | plone | < 4.1.1 | 4.1.1 | GHSA-p7h9-vf92-5fj5 |
| PyPI | products-cmfplone | < 4.0.7 | 4.0.7 | GHSA-p7h9-vf92-5fj5 |
| PyPI | products-cmfplone | >= 4.1a1, < 4.1rc3 | 4.1rc3 | GHSA-p7h9-vf92-5fj5 |
| PyPI | products-cmfplone | < 4.0.7 · >= 4.1a1, < 4.1rc3 | 4.0.7, 4.1rc3 | PYSEC-2026-2965 |
| PyPI | products-passwordresettool | < 2.0.6 | 2.0.6 | GHSA-p7h9-vf92-5fj5 |
Advisories 1
- RHSA-2012:0151 Red Hat Security Advisory: conga security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- 44775 third-party-advisory
- 48005 vdb-entry
- http://plone.org/products/plone/security/advisories/CVE-2011-1948
- 72727 vdb-entry
- 44776 third-party-advisory
- 8269 third-party-advisory
- plone-unspec-xss(67693) vdb-entry
- 20110526 [CVE-REQUEST] Plone XSS and permission errors mailing-list