PYSEC-2020-246

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...

Design/Logic Flaw

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

PYSEC-2020-248

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

PYSEC-2020-247

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...

Server side request forgery (ssrf)

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...

PYSEC-2020-247

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...

Design/Logic Flaw

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...

PYSEC-2020-248

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

PYSEC-2020-246

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...

CVE-2020-28736

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

CVE-2020-28736

CVE-2020-28736 affects Plone prior to 5.2.3. A XXE vulnerability exists in a feature protected by the unapplied permission plone.schemaeditor.ManageSchemata, making it accessible only to the Manager role. This leads to XML External Entity attacks that could impact confidentiality, integrity, and ...

CVE-2020-28736

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

CVE-2020-28735

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...

CVE-2020-28735

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature only available to the Manager role...

CVE-2020-28735

CVE-2020-28735 affects Plone versions before 5.2.3, where the tracebacks feature (accessible to the Manager role) enables SSRF attacks. The issue is described across multiple sources as a vulnerability in Plone prior to 5.2.3 that allows server-side request forgery via tracebacks. Remediation is ...

CVE-2020-28734

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...

CVE-2020-28734

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...

CVE-2020-28734

Plone before 5.2.3 is vulnerable to an XML External Entity (XXE) attack via a feature limited to the Manager role. The CVE entry (CVE-2020-28734) is corroborated by multiple connected sources (Red Hat, OSV, CNVD, GHSA, NVD, and OpenVAS entries) indicating an XXE issue that affects Plone versions ...

Plone 代码问题漏洞

Plone is an open source content management system. A XXE XML External Entity Injection vulnerability exists in Plone versions prior to 5.2.3. An attacker can exploit this vulnerability to conduct XXE attacks...

PT-2020-17037

Name of the Vulnerable Software and Affected Versions Plone versions prior to 5.2.3 Description The issue allows XXE attacks through a feature explicitly available to the Manager role. Recommendations For versions prior to 5.2.3, update to version 5.2.3 or later to resolve the issue...