CVE-2016-7138

Опубликовано: 07 мар. 2017

Источник: nvd

CVSS3: 6.1

CVSS2: 4.3

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Ссылки

http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2016/Oct/80
Third Party Advisory
VDB Entry
http://www.openwall.com/lists/oss-security/2016/09/05/4
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/05/5
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/archive/1/539572/100/0/threaded
http://www.securityfocus.com/bid/92752
https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone-1
Vendor Advisory
http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html
Exploit
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2016/Oct/80
Third Party Advisory
VDB Entry
http://www.openwall.com/lists/oss-security/2016/09/05/4
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/09/05/5
Mailing List
Patch
Third Party Advisory
http://www.securityfocus.com/archive/1/539572/100/0/threaded
http://www.securityfocus.com/bid/92752
https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone-1
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:3.3.6:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.0.8:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.0.10:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.1.1:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.1.2:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.1.3:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.1.4:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.1.5:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.1.6:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.2.6:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.2.7:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3.2:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3.3:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3.4:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3.5:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3.6:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3.7:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3.8:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3.9:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3.10:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:4.3.11:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.0:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.0:a1:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.0:rc1:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.0:rc2:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.0:rc3:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.0.2:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.0.3:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.0.4:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.0.5:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.0.6:*:*:*:*:*:*:*

cpe:2.3:a:plone:plone:5.1a1:*:*:*:*:*:*:*

EPSS

Процентиль: 73%

0.01588

Низкий

6.1 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2016-7138

CVSS3: 5.4

redhat

почти 10 лет назад

GHSA-v3hp-f8qr-cf3p