plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in versions 5.6.1 (for Plone 5.2), 6.0.3 (for Plone 6.0.0-6.0.4), 6.1.3 (for Plone 6.0.5-6.0.6), and 6.2.1 (for Plone 6.0.7). There are no known workarounds.

The version of Plone installed on the remote host is 5.2.x prior to 5.2.14 or 6.0.x prior to 6.0.7. It is, therefore, affected by the following vulnerabilities:

  - plone.namedfile has a stored cross-site scripting vulnerability for SVG images. (CVE-2023-41048)

  - When the ++api++ traverser in plone.rest is accidentally used multiple times in a url, handling it takes     increasingly longer, making the server less responsive (denial of service). (CVE-2023-42457)

  - Zope has a stored cross-site scripting vulnerability for SVG images; an attacker must first upload a     malicious SVG image and then trick a user into following a specially crafted link. (CVE-2023-42458)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Since a vendor hotfix (PloneHotfix20230921) may remediate this without a version upgrade, this plugin only reports when running in Paranoid mode.

The detected version of Plone python package, plone, is prior to version 5.2.14 or 6.x prior to 6.0.7. It is, therefore, affected by the following the vulnerabilities:

  - Multiple stored cross site scripting vulnerabilities exits when handling SVG images. An authenticated,     remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute     arbitrary script code in a user's browser session. (CVE-2023-41048, CVE-2023-42458)

  - A denial of service (DoS) vulnerability exists in plone.rest. An unauthenticated, remote attacker can     exploit this issue, to cause the server to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone
    Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross site
    scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this by making
    sure SVG images are always downloaded instead of shown inline. But the same problem still exists for
    scales of SVG images. Note that an image tag with an SVG image as source is not vulnerable, even when the
    SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an
    image, and then trick a user into following a specially crafted link. Patches are available in versions
    5.6.1 (for Plone 5.2), 6.0.3 (for Plone 6.0.0-6.0.4), 6.1.3 (for Plone 6.0.5-6.0.6), and 6.2.1 (for Plone
    6.0.7). There are no known workarounds. (CVE-2023-41048)

ID	Name	Product	Family	Severity
329028	Plone 5.2.x < 5.2.14 / 6.0.x < 6.0.7 Multiple Vulnerabilities (HF 20230921)	Nessus	Misc.	medium
300605	Plone Python Library Multiple Vulnerabilities (20230921)	Nessus	Misc.	medium
416413	SCA: security update for plone.namedfile (GHSA-jj7c-jrv4-c65x)	Tenable Cloud Security	SCA Checks	medium
416413	SCA: security update for plone.namedfile (GHSA-jj7c-jrv4-c65x)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2023-41048

medium

Tenable Plugins

medium

medium

medium

medium