Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user's cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.

The version of Plone installed on the remote host is 4.3 prior to 5.2.7. It is, therefore, affected by a reflected cross-site scripting (XSS) and open redirect vulnerability exists in 'Products.ATContentTypes'. An unauthenticated, remote attacker can get a compromised version of the image_view_fullscreen page in a cache. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Since a vendor hotfix (PloneHotfix20220128) may remediate this without a version upgrade, this plugin only reports when running in Paranoid mode.

The detected version of Plone, is prior to version 5.2.7, or version 6 prior to 6.0.0a3. It is, therefore, affected by a cross site scripting vulnerability. A remote attacker can exploit this via cache poisoning to redirect a user when clicking links on the compromised page.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are
    dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site
    scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen
    page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can
    get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this
    depends on the user's cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a
    fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen
    page is not stored in the cache. More information about the vulnerability and cvmitigation measures is
    available in the GitHub Security Advisory. (CVE-2022-23599)

ID	Name	Product	Family	Type	Severity
329029	Plone 4.3 < 5.2.7 Reflected XSS and Open Redirect (HF 20220128)	Nessus	Misc.	Local	medium
300644	Plone < 5.2.7 / 6.x < 6.0.0a3 XSS (CVE-2022-23599)	Nessus	Misc.	Local	medium
414850	SCA: security update for Products.ATContentTypes (GHSA-g4c2-ghfg-g5rh)	Tenable Cloud Security	SCA Checks	Local	medium
414850	SCA: security update for Products.ATContentTypes (GHSA-g4c2-ghfg-g5rh)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2022-23599

medium

Tenable Plugins

medium

medium

medium

medium