PYSEC-2020-248

2020-12-3019:15:00

Google

osv.dev

0.003 Low

EPSS

Percentile

68.5%

JSON

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

CPENameOperatorVersion
ploneeq5.2rc2
ploneeq4.2.1
ploneeq5.2rc3
ploneeq4.3.17
ploneeq4.3.16
ploneeq4.0.1
ploneeq4.3.9
ploneeq4.3.20
ploneeq5.0.6
ploneeq5.2rc5