GHSA-gc9g-67cq-p7v4

Server-Side Request Forgery in Plone

Source: GitHub Advisory Database (reviewed) High CVE-2021-33511

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Plone	<= 5.2.4	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-33511 advisory
https://github.com/advisories/GHSA-gc9g-67cq-p7v4 advisory
https://github.com/plone/Plone package
https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-83.yaml web
https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser web
http://www.openwall.com/lists/oss-security/2021/05/22/1 web