plone 6.0.0rc1: known vulnerabilities

Could not compare 2 records. The results are incomplete.

1. CVE-2024-22889

   Medium · CVSS 5.5EPSS 0.7%Public exploitNo fix published

   CVE-2024-22889

   Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.

   plonePython

   Published March 5, 2024Updated October 31, 2024

   Source advisory 1 ↗Source advisory 2 ↗

2. CVE-2024-0669

   Medium · CVSS 6.3EPSS 0.29%Fix available

   Cross-Frame Scripting (XFS) on Plone CMS

   A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.

   plonePython

   • Update to 6.0.7

   Published January 18, 2024Updated June 17, 2025

   Source advisory 1 ↗Source advisory 2 ↗

3. CVE-2006-1711

   Not ratedEPSS 4.02%Public exploitNo fix published

   CVE-2006-1711

   Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

   plonePython

   Published April 11, 2006Updated August 7, 2024

   Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗