SB2021052811 - Multiple vulnerabilities in Plone
Published: May 28, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 6 secuirty vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2021-33508)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to a full name that is mishandled during rendering of the ownership tab of a content item. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Cross-site scripting (CVE-ID: CVE-2021-33513)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the inline_diff methods in Products.CMFDiffTool. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
3) StoredcCross-site scripting (CVE-ID: CVE-2021-33512)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within the SVG or HTML document. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2021-33511)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input in the lxml parser. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
5) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2021-33510)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input in an event ical URL. A remote authenticated attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
6) Incorrect permission assignment for critical resource (CVE-ID: CVE-2021-33509)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to incorrect permission assignment for critical resource. A remote authenticated attacker can perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.
Remediation
Install update from vendor's website.
References
- https://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname
- http://www.openwall.com/lists/oss-security/2021/05/22/1
- https://plone.org/security/hotfix/20210518/xss-vulnerability-in-cmfdifftool
- https://plone.org/security/hotfix/20210518/stored-xss-from-file-upload-svg-html
- https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser
- https://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url
- https://plone.org/security/hotfix/20210518/writing-arbitrary-files-via-docutils-and-python-script