Skip to content
OpenAdvisories
High · 8.8 CVE-2020-28734 EUVD-2020-0140GHSA-wq6x-g685-w5f2PYSEC-2020-246PYSEC-2026-2880PYSEC-2026-2883PYSEC-2026-2886PYSEC-2026-736

Improper Restriction of XML External Entity Reference in Plone

Published Dec 30, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: plone Package: plone-app-dexterity Package: plone-app-event Package: plone-app-theming Package: plone-supermodel Ecosystem: PyPI

Description

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI plone < 5.2.3 5.2.3 GHSA-wq6x-g685-w5f2
PyPI plone-app-dexterity < 2.6.8 2.6.8 GHSA-wq6x-g685-w5f2
PyPI plone-app-event < 3.2.10 3.2.10 GHSA-wq6x-g685-w5f2
PyPI plone-app-theming < 4.1.6 4.1.6 GHSA-wq6x-g685-w5f2
PyPI plone-supermodel < 1.6.3 1.6.3 GHSA-wq6x-g685-w5f2

References