Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-7140.

The version of Plone installed on the remote host is 2.5.5 prior to 4.3.12, or 5.0.x prior to 5.0.7. It is, therefore, affected by the following vulnerabilities:

  - Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope     ZMI in Plone allows remote attackers to inject arbitrary web script or HTML via vectors involving double     quotes, as demonstrated by the obj_ids:tokens parameter. (CVE-2016-7147)

  - Plone allows remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by     leveraging the Python string format method. (CVE-2017-5524)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Since a vendor hotfix (PloneHotfix20170117) may remediate this without a version upgrade, this plugin only reports when running in Paranoid mode.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope     ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or     HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this     vulnerability exists because of an incomplete fix for CVE-2016-7140. (CVE-2016-7147)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Cross-site scripting (XSS) vulnerability in the manage_findResult component in the search feature in Zope
    ZMI in Plone before 4.3.12 and 5.x before 5.0.7 allows remote attackers to inject arbitrary web script or
    HTML via vectors involving double quotes, as demonstrated by the obj_ids:tokens parameter. NOTE: this
    vulnerability exists because of an incomplete fix for CVE-2016-7140. (CVE-2016-7147)

ID	Name	Product	Family	Severity
329022	Plone 2.5.5 < 4.3.12 / 5.0.x < 5.0.7 Multiple Vulnerabilities (HF 20170117)	Nessus	Misc.	medium
263754	Linux Distros Unpatched Vulnerability : CVE-2016-7147	Nessus	Misc.	medium
433559	SCA: security update for plone (GHSA-84jm-cpc5-c7g7)	Tenable Cloud Security	SCA Checks	medium
433559	SCA: security update for plone (GHSA-84jm-cpc5-c7g7)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2016-7147

medium

Tenable Plugins

medium

medium

medium

medium