CVE-2011-1948
CVE-2011-1948
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS 6.1 · Medium · EPSS 2.4% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
products-passwordresettool PyPI
- Versions
- 1.1
- 1.2
- 1.3
- 1.4
- 2.0
- 2.0.1
- 2.0.2
- 2.0.3
- 2.0.4
- 2.0.5
- 2.0a1
- 2.0b1
- 2.0b2
- 2.0b3
- 2.0b4
- 2.0b5
- 2.0b6
- 2.0b7
- Affected ranges
- ECOSYSTEM: < 2.0.6
Update to 2.0.6
products-cmfplone PyPI
- Versions
- 4.0b1
- Affected ranges
- ECOSYSTEM: < 4.0.7
Update to 4.0.7
products-cmfplone PyPI
- Versions
- 4.1a1
- 4.1a2
- 4.1a3
- 4.1b1
- 4.1b2
- 4.1rc2
- Affected ranges
- ECOSYSTEM: ≥ 4.1a1, < 4.1rc3
Update to 4.1rc3
plone PyPI
- Versions
- 3.2
- 3.2.1
- 3.2.2
- 3.2.3
- 3.2a1
- 3.2rc1
- 3.3
- 3.3.1
- 3.3.2
- 3.3.3
- 3.3.4
- 3.3.5
- 3.3.6
- 3.3b1
- 3.3rc1
- 3.3rc2
- 3.3rc3
- 3.3rc4
- 3.3rc5
- 4.0
- 4.0.1
- 4.0.10
- 4.0.2
- 4.0.3
- 4.0.4
- 4.0.5
- 4.0.6
- 4.0.7
- 4.0.8
- 4.0.9
- 4.0a1
- 4.0a2
- 4.0a3
- 4.0a4
- 4.0a5
- 4.0b1
- 4.0b2
- 4.0b3
- 4.0b4
- 4.0b5
- 4.0rc1
- 4.1
- 4.1a1
- 4.1a2
- 4.1a3
- 4.1b1
- 4.1b2
- 4.1rc2
- 4.1rc3
- Affected ranges
- ECOSYSTEM: < 4.1.1
Update to 4.1.1
products-cmfplone PyPI
- Versions
- 4.0b1
- 4.1a1
- 4.1a2
- 4.1a3
- 4.1b1
- 4.1b2
- 4.1rc2
- Affected ranges
- ECOSYSTEM: < 4.0.7 ∪ ≥ 4.1a1, < 4.1rc3
Update to 4.0.7; Update to 4.1rc3
Original sources
- http://secunia.com/advisories/44775
- http://www.securityfocus.com/bid/48005
- http://plone.org/products/plone/security/advisories/CVE-2011-1948
- http://osvdb.org/72727
- http://secunia.com/advisories/44776
- http://securityreason.com/securityalert/8269
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67693
- http://www.securityfocus.com/archive/1/518155/100/0/threaded
- https://nvd.nist.gov/vuln/detail/CVE-2011-1948