MEDIUM5.4
PYSEC-2026-2962
Products.CMFPlone XSS in profile home_page property
Quick fix
PYSEC-2026-2962 — products-cmfplone: upgrade to the fixed version with the command below.
pip install --upgrade 'products-cmfplone>=4.3.17'Details
A member of the Plone site could set javascript in the `home_page` property of their profile, and have this executed when a visitor clicks the home page link on the author page.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/products-cmfplone
Introduced in:
0Fixed in: 4.3.17Fix
pip install --upgrade 'products-cmfplone>=4.3.17'References
- https://nvd.nist.gov/vuln/detail/CVE-2017-1000482[ADVISORY]
- https://github.com/plone/Products.CMFPlone/issues/2232[WEB]
- https://github.com/plone/Products.CMFPlone/pull/2233[WEB]
- https://github.com/plone/Products.CMFPlone/pull/2234[WEB]
- https://github.com/plone/Products.CMFPlone/pull/2235[WEB]
- https://github.com/plone/Products.CMFPlone/pull/2236[WEB]
- https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab[WEB]
- https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b[WEB]
- https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8[WEB]
- https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373[WEB]
- https://github.com/plone/Products.CMFPlone[PACKAGE]
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-71.yaml[WEB]
- https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property[WEB]
- https://pypi.org/project/products-cmfplone[PACKAGE]
- https://github.com/advisories/GHSA-859j-668v-mrr6[ADVISORY]