5 matches found
GHSA-8RQH-VXPR-X77P plone.restapi: Stored XSS by spoofing mime type
Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...
Cross-site Scripting (XSS)
Overview plone.restapi is a RESTful hypermedia API for Plone. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the RichTextValue.output function when the stored mimeType equals the outputMimeType, causing unsanitized content to bypass the safehtml transform and be...
plone.restapi: Stored XSS by spoofing mime type
Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...
