Skip to content
OpenAdvisories
Medium · 6.1 CVE-2021-33507 EUVD-2021-0189GHSA-35rg-466w-77h3PYSEC-2021-79PYSEC-2026-2961PYSEC-2026-2967

Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone

Published May 21, 2021 · Updated Aug 3, 2024 · Assigned by mitre

Package: plone Package: products-cmfcore Package: products-pluggableauthservice Ecosystem: PyPI

Description

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI plone <= 5.2.4 — GHSA-35rg-466w-77h3
PyPI plone < 5.2.5 5.2.5 PYSEC-2021-79
PyPI products-cmfcore < 2.5.1 2.5.1 GHSA-35rg-466w-77h3
PyPI products-pluggableauthservice < 2.6.2 2.6.2 GHSA-35rg-466w-77h3

References