SSRF attacks via tracebacks in Plone

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...

CVE-2020-28734

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...

Design/Logic Flaw

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...

PYSEC-2020-248

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

CVE-2020-28736

CVE-2020-28736 affects Plone prior to 5.2.3. A XXE vulnerability exists in a feature protected by the unapplied permission plone.schemaeditor.ManageSchemata, making it accessible only to the Manager role. This leads to XML External Entity attacks that could impact confidentiality, integrity, and ...

CVE-2020-28735

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...