CVE-2020-28736
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).
- Update to 4.1.6
Published Updated
PatchFirst · Latest vulnerabilities
plone-app-theming vulnerabilities
Vulnerabilities published for plone-app-theming in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 3
CVE-2020-28735
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).
- Update to 4.1.6
Published UpdatedCVE-2020-28734
Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.
- Update to 4.1.6
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.