GHSA-35rg-466w-77h3

Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-33507

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Products.CMFCore	< 2.5.1	2.5.1
PyPI	Products.PluggableAuthService	< 2.6.2	2.6.2
PyPI	Plone	<= 5.2.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-33507 advisory
https://github.com/advisories/GHSA-35rg-466w-77h3 advisory
https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-79.yaml web
https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots web
http://www.openwall.com/lists/oss-security/2021/05/22/1 web