Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The version of Plone installed on the remote host is 3.3.x prior to 4.3.12, or 5.0.x < 5.0.7. It is, therefore, affected by the following vulnerabilities:

  - Directory traversal vulnerability in Plone CMS allows remote administrators to read arbitrary files via a     .. (dot dot) in the path parameter in a getFile action to     Plone/++theme++barceloneta/@@plone.resourceeditor.filemanager-actions. (CVE-2016-7135)

  - z3c.form in Plone CMS allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted     GET request. (CVE-2016-7136)

  - Multiple open redirect vulnerabilities in Plone CMS allow remote attackers to redirect users to arbitrary     web sites and conduct phishing attacks via a URL in the referer parameter to (1)     %2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions or (2)     folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions or the (3) came_from     parameter to /login_form. (CVE-2016-7137)

  - Cross-site scripting (XSS) vulnerability in the URL checking infrastructure in Plone CMS allows remote     attackers to inject arbitrary web script or HTML via a crafted URL. (CVE-2016-7138)

  - Cross-site scripting (XSS) vulnerability in an unspecified page template in Plone allows remote attackers     to inject arbitrary web script or HTML via unknown vectors. (CVE-2016-7139)

  - Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS allow remote     attackers to inject arbitrary web script or HTML via unspecified vectors. (CVE-2016-7140)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Since a vendor hotfix (PloneHotfix20160830) may remediate this without a version upgrade, this plugin only reports when running in Paranoid mode.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through
    5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script
    or HTML via unspecified vectors. (CVE-2016-7140)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Multiple cross-site scripting (XSS) vulnerabilities in the ZMI page in Zope2 in Plone CMS 5.x through     5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to inject arbitrary web script     or HTML via unspecified vectors. (CVE-2016-7140)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
329006	Plone 3.3.x < 4.3.12 / 5.0.x < 5.0.7 Multiple Vulnerabilities (HF 20160830)	Nessus	Misc.	Local	medium
433031	SCA: security update for Plone (GHSA-chvw-gjxf-f8mc)	Tenable Cloud Security	SCA Checks	Local	medium
433031	SCA: security update for Plone (GHSA-chvw-gjxf-f8mc)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
219975	Linux Distros Unpatched Vulnerability : CVE-2016-7140	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2016-7140

medium

Tenable Plugins

medium

medium

medium

medium