GHSA-wq6x-g685-w5f2
Improper Restriction of XML External Entity Reference in Plone
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | Plone | < 5.2.3 | 5.2.3 |
| PyPI | plone.app.event | < 3.2.10 | 3.2.10 |
| PyPI | plone.app.theming | < 4.1.6 | 4.1.6 |
| PyPI | plone.app.dexterity | < 2.6.8 | 2.6.8 |
| PyPI | plone.supermodel | < 1.6.3 | 1.6.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2020-28734
- https://github.com/plone/Products.CMFPlone/issues/3209
- https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
- https://github.com/advisories/GHSA-wq6x-g685-w5f2
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-246.yaml
- https://www.misakikata.com/codes/plone/python-en.html