GMS-2022-46: Cross-site Scripting and Open Redirect in Products.CMFPlone

January 28, 2022 (updated January 31, 2022)

Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish.

References

github.com/advisories/GHSA-8w54-22w9-3g8f
github.com/plone/Products.CMFPlone/security/advisories/GHSA-8w54-22w9-3g8f

Code Behaviors & Features

Detect and mitigate GMS-2022-46 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →