CVE-2022-4638 (Python, published 2022-12-21T22:15Z)
Description: value: A vulnerability classified as problematic was found in collective.contact.widget up to 1.12. This vulnerability affects the function title of the file src/collective/contact/widget/widgets.py. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 5da36305ca7ed433782be8901c47387406fcda12. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216496.
Severity: nan (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/collective/collective.contact.widget
Files changed:
CHANGES.rst
src/collective/contact/widget/widgets.py
Commit message: Escaped term-contact viewlet title special chars to avoid xss


Vulnerable code:
- Nothing changed yet.

import json

import z3c.form.interfaces
from zope.interface import implementer, implements, Interface
from zope.browserpage.viewpagetemplatefile import ViewPageTemplateFile
from five import grok
from Products.CMFPlone.utils import base_hasattr, safe_unicode
from plone.app.layout.viewlets.interfaces import IBelowContent
from plone.app.layout.viewlets.interfaces import IHtmlHeadLinks
from plone.formwidget.autocomplete.widget import (
    AutocompleteMultiSelectionWidget,
    AutocompleteSelectionWidget)
from plone.formwidget.autocomplete.widget import AutocompleteSearch as BaseAutocompleteSearch
    from plone.formwidget.masterselect.widget import MasterSelect as BaseMasterSelect
from collective.contact.widget import _
from collective.contact.widget.interfaces import (
    IContactAutocompleteWidget,
    IContactAutocompleteSelectionWidget,
    IContactAutocompleteMultiSelectionWidget,
    IContactContent,
    IContactWidgetSettings,
)

        return title

Fixed code:
- Escaped contact title special characters in `term-contact` viewlet to avoid
  script insertion (xss). This viewlet stores an hidden field used in a
  dynamically js generation.
  [sgeulette]
from cgi import escape
from collective.contact.widget import _
from collective.contact.widget.interfaces import IContactAutocompleteMultiSelectionWidget
from collective.contact.widget.interfaces import IContactAutocompleteSelectionWidget
from collective.contact.widget.interfaces import IContactAutocompleteWidget
from collective.contact.widget.interfaces import IContactContent
from collective.contact.widget.interfaces import IContactWidgetSettings
from five import grok
from plone.app.layout.viewlets.interfaces import IBelowContent
from plone.app.layout.viewlets.interfaces import IHtmlHeadLinks
from plone.formwidget.autocomplete.widget import AutocompleteMultiSelectionWidget
from plone.formwidget.autocomplete.widget import AutocompleteSearch as BaseAutocompleteSearch
from plone.formwidget.autocomplete.widget import AutocompleteSelectionWidget
from Products.CMFPlone.utils import base_hasattr
from Products.CMFPlone.utils import safe_unicode
from zope.browserpage.viewpagetemplatefile import ViewPageTemplateFile
from zope.interface import implementer
from zope.interface import implements
from zope.interface import Interface
import json
import z3c.form.interfaces

    from plone.formwidget.masterselect.widget import MasterSelect as BaseMasterSelect
        return escape(title, quote=True)