CVE-2016-7147
Publication date 4 February 2017
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140.
Status
Package | Ubuntu Release | Status |
---|---|---|
zope2.13 | 24.10 oracular | Not in release |
24.04 LTS noble | Not in release | |
22.04 LTS jammy | Not in release | |
20.04 LTS focal | Not in release | |
18.04 LTS bionic |
Vulnerable
|
|
16.04 LTS xenial |
Vulnerable
|
|
14.04 LTS trusty | Not in release | |
Severity score breakdown
Parameter | Value |
---|---|
Base score | 6.1 · Medium |
Attack vector | Network |
Attack complexity | Low |
Privileges required | None |
User interaction | Required |
Scope | Changed |
Confidentiality | Low |
Integrity impact | Low |
Availability impact | None |
Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
References
Other references
- https://plone.org/security/hotfix/20170117
- https://plone.org/security/hotfix/20170117/non-persistent-xss-in-zope2
- https://www.curesec.com/blog/article/blog/Plone-XSS-186.html
- https://github.com/zopefoundation/Zope/pull/86/commits/e130ee11fe36255b90c85404520b503e29e16e09
- https://www.cve.org/CVERecord?id=CVE-2016-7147