Plone Cross-site Scripting (XSS) vulnerability
Date: 2022-05
Affected: pip/Plone, pip/Plone, pip/Plone
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2016-7138
CVE-2016-7139
CVE-2016-7140
CWE: CWE-79
CVSS: 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.


Mitigations:

Architectural layers (MAESTRO):