CVE-2011-1949
CVE-2011-1949
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-2422.
CVSS 5.4 · Medium · EPSS 1.9% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
plone PyPI
- Versions
- 3.3.2
- 3.3.3
- 3.3.4
- 3.3.5
- Affected ranges
- ECOSYSTEM: ≥ 3.3.2, < 3.3.6
Update to 3.3.6
plone PyPI
- Versions
- 4.0
- 4.0.1
- 4.0.2
- 4.0.3
- 4.0.4
- 4.0.5
- 4.0a1
- 4.0a2
- 4.0a3
- 4.0a4
- 4.0a5
- 4.0b1
- 4.0b2
- 4.0b3
- 4.0b4
- 4.0b5
- 4.0rc1
- Affected ranges
- ECOSYSTEM: ≥ 4.0a0, < 4.0.6
Update to 4.0.6
plone PyPI
- Versions
- 4.1
- 4.1a1
- 4.1a2
- 4.1a3
- 4.1b1
- 4.1b2
- 4.1rc2
- 4.1rc3
- Affected ranges
- ECOSYSTEM: ≥ 4.1a0, < 4.1.1
Update to 4.1.1
plone PyPI
- Versions
- 3.2
- 3.2.1
- 3.2.2
- 3.2.3
- 3.2a1
- 3.2rc1
- 3.3
- 3.3.1
- 3.3.2
- 3.3.3
- 3.3.4
- 3.3.5
- 3.3.6
- 3.3b1
- 3.3rc1
- 3.3rc2
- 3.3rc3
- 3.3rc4
- 3.3rc5
- 4.0
- 4.0.1
- 4.0.10
- 4.0.2
- 4.0.3
- 4.0.4
- 4.0.5
- 4.0.6
- 4.0.7
- 4.0.8
- 4.0.9
- 4.0a1
- 4.0a2
- 4.0a3
- 4.0a4
- 4.0a5
- 4.0b1
- 4.0b2
- 4.0b3
- 4.0b4
- 4.0b5
- 4.0rc1
- 4.1
- 4.1a1
- 4.1a2
- 4.1a3
- 4.1b1
- 4.1b2
- 4.1rc2
- 4.1rc3
- Affected ranges
- ECOSYSTEM: < 4.1.1
Update to 4.1.1
Original sources
- http://osvdb.org/72728
- http://secunia.com/advisories/44775
- http://plone.org/products/plone/security/advisories/CVE-2011-1949
- http://www.securityfocus.com/bid/48005
- http://secunia.com/advisories/44776
- http://securityreason.com/securityalert/8269
- https://exchange.xforce.ibmcloud.com/vulnerabilities/67694
- http://www.securityfocus.com/archive/1/518155/100/0/threaded
- https://nvd.nist.gov/vuln/detail/CVE-2011-1949