CVE-2024-0669: Improper Restriction of Rendered UI Layers or Frames

January 18, 2024 (updated January 19, 2024)

A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.

References

github.com/advisories/GHSA-5xfx-55x4-j223
nvd.nist.gov/vuln/detail/CVE-2024-0669
www.incibe.es/en/incibe-cert/notices/aviso/cross-frame-scripting-xfs-plone-cms

Code Behaviors & Features

Detect and mitigate CVE-2024-0669 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →