medium4.3
CVE-2011-1340
Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary we…
Impact
Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to Members/ipa/createObject.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Plone | Plone | through 2.5.2 Versions 1.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- http://dev.plone.org/plone/changeset/12262
- http://dev.plone.org/plone/ticket/6110
- http://jvn.jp/en/jp/JVN41222793/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2011-000056
- http://dev.plone.org/plone/changeset/12262
- http://dev.plone.org/plone/ticket/6110
- http://jvn.jp/en/jp/JVN41222793/index.html
- http://jvndb.jvn.jp/jvndb/JVNDB-2011-000056