Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel...
7.5CVSS6.8AI score0.0115EPSS
SaveExploits0References1
OSV•added 2020/12/30 7:15 p.m.•35 views
PYSEC-2020-247
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...
