Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in Zope 4.8.10 and 5.8.5. As a workaround, make sure the "Add Documents, Images, and Files" permission is only assigned to trusted roles. By default, only the Manager has this permission.

The version of Plone installed on the remote host is 5.2.x prior to 5.2.14 or 6.0.x prior to 6.0.7. It is, therefore, affected by the following vulnerabilities:

  - plone.namedfile has a stored cross-site scripting vulnerability for SVG images. (CVE-2023-41048)

  - When the ++api++ traverser in plone.rest is accidentally used multiple times in a url, handling it takes     increasingly longer, making the server less responsive (denial of service). (CVE-2023-42457)

  - Zope has a stored cross-site scripting vulnerability for SVG images; an attacker must first upload a     malicious SVG image and then trick a user into following a specially crafted link. (CVE-2023-42458)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Since a vendor hotfix (PloneHotfix20230921) may remediate this without a version upgrade, this plugin only reports when running in Paranoid mode.

The detected version of Plone python package, plone, is prior to version 5.2.14 or 6.x prior to 6.0.7. It is, therefore, affected by the following the vulnerabilities:

  - Multiple stored cross site scripting vulnerabilities exits when handling SVG images. An authenticated,     remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute     arbitrary script code in a user's browser session. (CVE-2023-41048, CVE-2023-42458)

  - A denial of service (DoS) vulnerability exists in plone.rest. An unauthenticated, remote attacker can     exploit this issue, to cause the server to stop responding.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross
    site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never
    vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker
    would first need to upload an image, and then trick a user into following a specially crafted link.
    Patches are available in Zope 4.8.10 and 5.8.5. As a workaround, make sure the "Add Documents, Images, and
    Files" permission is only assigned to trusted roles. By default, only the Manager has this permission.
    (CVE-2023-42458)

ID	Name	Product	Family	Severity
329028	Plone 5.2.x < 5.2.14 / 6.0.x < 6.0.7 Multiple Vulnerabilities (HF 20230921)	Nessus	Misc.	medium
300605	Plone Python Library Multiple Vulnerabilities (20230921)	Nessus	Misc.	medium
419994	SCA: security update for Zope (GHSA-wm8q-9975-xh5v)	Tenable Cloud Security	SCA Checks	medium
419994	SCA: security update for Zope (GHSA-wm8q-9975-xh5v)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2023-42458

medium

Tenable Plugins

medium

medium

medium

medium