-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly identifies the wysiwyg.py component as the source of the path exposure. The error message leak implies a function handling URL requests in this component fails to properly sanitize error output. The getResource() function is a common pattern in Plone's WYSIWYG implementation for serving resources (e.g., images, scripts). Invalid resource requests would trigger exceptions containing filesystem paths in error messages. This aligns with CWE-200's exposure via error messages, and the component/file path matches the advisory details.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| plone | pip | >= 2.1, <= 4.1 | 4.1.1 |
| plone | pip | >= 4.2, < 4.2.6 | 4.2.6 |
| plone | pip | >= 4.3, < 4.3.2 | 4.3.2 |