Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site scripting (XSS) vulnerabilities in (1) spamProtect.py, (2) pts.py, and (3) request.py
    in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to inject
    arbitrary web script or HTML via unspecified vectors. (CVE-2013-4190)

The version of Plone installed on the remote web server is affected by a cross-site scripting vulnerability because it fails to properly sanitize input to the 'mailaddress' parameter of the 'spamProtect.py' script.  An attacker may be able to leverage this to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected site. 

Note that the application is also reportedly affected by several additional vulnerabilities. Some of the reported vulnerabilities include but are not limited to arbitrary code execution, privilege escalation, denial of service (DoS), open redirect, cross-site scripting, as well as several additional flaws; however, Nessus has not tested for the additional issues.

ID	Name	Product	Family	Severity
431851	SCA: security update for plone (GHSA-89rq-27xp-vgv7)	Tenable Cloud Security	SCA Checks	medium
431851	SCA: security update for plone (GHSA-89rq-27xp-vgv7)	Tenable Self-Hosted Container Security	SCA Checks	medium
67205	Plone spamProtect mailaddress Parameter XSS	Nessus	CGI abuses : XSS	medium

Detections

Analytics

CVE-2013-4190

medium

Tenable Plugins

medium

medium

medium