-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| plone | pip | = 5.0rc1 | |
| Plone | pip | >= 3.3, <= 3.3.6 | 3.3.7 |
| Plone | pip | >= 4.0, <= 4.0.10 | 4.0.11 |
| Plone | pip | >= 4.1, <= 4.1.6 | 4.1.7 |
| Plone | pip | >= 4.2, <= 4.2.7 | 4.2.8 |
| Plone | pip | >= 4.3, < 4.3.7 | 4.3.7 |
Miggo AIRoot Cause AnalysisThe GitHub commit 3da710a shows the vulnerability was patched by adding explicit checks for XSS patterns in the isURLInPortal method of URLTool.py. The advisory descriptions explicitly mention this URL validation method as the attack vector, and the added test cases in testURLTool.py verify the XSS prevention logic was implemented in this function. The function's purpose (validating URLs within the Plone site) directly aligns with the vulnerability's attack vector described in CVE-2015-7316.