Vulnerability Details : CVE-2016-7136

z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.11 allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted GET request.

Vulnerability category: Cross site scripting (XSS)

Published 2017-03-07 16:59:01

Updated 2018-10-09 20:00:53

Source MITRE

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2016-7136

Probability of exploitation activity in the next 30 days: 0.35%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 68 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2016-7136

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	nvd@nist.gov
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.1	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	nvd@nist.gov
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2016-7136

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-7136

http://seclists.org/fulldisclosure/2016/Oct/80

Full Disclosure: Multiple Vulnerabilities in Plone CMS
Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securityfocus.com/archive/1/539572/100/0/threaded

SecurityFocus

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2016/09/05/4

oss-security - Re: CVE request: Plone multiple vulnerabilities
Mailing List;Patch;Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2016/09/05/5

oss-security - Re: CVE request: Plone multiple vulnerabilities
Mailing List;Patch;Third Party Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/92752

Plone Multiple Security vulnerabilities

CVEs referencing this url
https://plone.org/security/hotfix/20160830/non-persistent-xss-in-plone-forms

Non-Persistent XSS in Plone forms — Plone.org
Vendor Advisory
http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html

Plone CMS 4.3.11 / 5.0.6 XSS / Traversal / Open Redirection ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry

CVEs referencing this url

Products affected by CVE-2016-7136

Plone » Plone » Version: 4.0
cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.0.1
cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.0.5
cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.0.4
cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.0.3
cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.0.2
cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.1
cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.0.8
cpe:2.3:a:plone:plone:4.0.8:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.0.7
cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.2
cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.0.9
cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.1.2
cpe:2.3:a:plone:plone:4.1.2:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.1.1
cpe:2.3:a:plone:plone:4.1.1:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.1.6
cpe:2.3:a:plone:plone:4.1.6:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.1.5
cpe:2.3:a:plone:plone:4.1.5:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3
cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.2.1
cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.1.4
cpe:2.3:a:plone:plone:4.1.4:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3.1
cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.2.3
cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.2.4
cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.2.5
cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.2.2
cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.1.3
cpe:2.3:a:plone:plone:4.1.3:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.2.6
cpe:2.3:a:plone:plone:4.2.6:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.2.7
cpe:2.3:a:plone:plone:4.2.7:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3.2
cpe:2.3:a:plone:plone:4.3.2:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3.11
cpe:2.3:a:plone:plone:4.3.11:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3.10
cpe:2.3:a:plone:plone:4.3.10:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3.9
cpe:2.3:a:plone:plone:4.3.9:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3.8
cpe:2.3:a:plone:plone:4.3.8:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3.3
cpe:2.3:a:plone:plone:4.3.3:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.0.10
cpe:2.3:a:plone:plone:4.0.10:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3.6
cpe:2.3:a:plone:plone:4.3.6:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3.4
cpe:2.3:a:plone:plone:4.3.4:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3.7
cpe:2.3:a:plone:plone:4.3.7:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 4.3.5
cpe:2.3:a:plone:plone:4.3.5:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.0 Update RC1
cpe:2.3:a:plone:plone:5.0:rc1:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.0 Update RC3
cpe:2.3:a:plone:plone:5.0:rc3:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.0.2
cpe:2.3:a:plone:plone:5.0.2:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.0.3
cpe:2.3:a:plone:plone:5.0.3:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.0.4
cpe:2.3:a:plone:plone:5.0.4:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.0
cpe:2.3:a:plone:plone:5.0:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.1a1
cpe:2.3:a:plone:plone:5.1a1:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.0 Update RC2
cpe:2.3:a:plone:plone:5.0:rc2:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.0.1
cpe:2.3:a:plone:plone:5.0.1:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.0 Update A1
cpe:2.3:a:plone:plone:5.0:a1:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.0.6
cpe:2.3:a:plone:plone:5.0.6:*:*:*:*:*:*:*
Matching versions
Plone » Plone » Version: 5.0.5
cpe:2.3:a:plone:plone:5.0.5:*:*:*:*:*:*:*
Matching versions