-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| plone | pip | >= 4.0, <= 4.3.11 | 4.3.12 |
| plone | pip | >= 5.0, <= 5.0.6 | 5.0.7 |
Miggo AIRoot Cause AnalysisThe vulnerability explicitly references manage_findResult as the vulnerable component in Zope ZMI. The CVE description demonstrates exploitation via obj_ids:tokens parameter manipulation with double quotes, indicating insufficient output encoding in the search result template. While exact file paths aren't shown in sources, Zope's management interface uses DTML templates like findResult.dtml for rendering search results, and incomplete escaping in these templates would directly enable the described XSS.