FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

plone -- multiple vulnerabilities

Affected packages
plone < 4.3.7

Details

VuXML ID 6b3374d4-6b0b-11e5-9909-002590263bf5
Discovery 2015-09-10
Entry 2015-10-05

Plone.org reports:

Versions Affected: All current Plone versions.

Versions Not Affected: None.

Nature of vulnerability: Allows creation of members by anonymous users on sites that have self-registration enabled, allowing bypass of CAPTCHA and similar protections against scripted attacks.

The patch can be added to buildouts as Products.PloneHotfix20150910 (available from PyPI) or downloaded from Plone.org.

Immediate Measures You Should Take: Disable self-registration until you have applied the patch.

Plone's URL checking infrastructure includes a method for checking if URLs valid and located in the Plone site. By passing HTML into this specially crafted url, XSS can be achieved.

References

FreeBSD PR ports/203255
URL https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087
URL https://plone.org/products/plone-hotfix/releases/20150910
URL https://plone.org/products/plone/security/advisories/20150910-announcement
URL https://plone.org/security/20150910/non-persistent-xss-in-plone