CVE-2020-28736

2020-12-3019:15:13

Google

osv.dev

7 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

68.5%

JSON

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

CPENameOperatorVersion
ploneeq4.2b2
ploneeq4.1rc1
ploneeq5.2rc2
ploneeq5.2rc3
ploneeq4.1a3
ploneeq5.0b1
ploneeq5.2rc5
ploneeq5.0b4
ploneeq5.0
ploneeq4.1b2