-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper URL validation in the isURLInPortal method. The commit 05a943ecbcdda56bacc93b55c9e2e908d8a7dfab shows critical changes to this function: introducing ALLOWED_SCHEMAS to restrict protocols, BAD_URL_PARTS to block XSS patterns, and HTML unescaping to prevent encoded payloads. These changes directly address the XSS vector described in CVE-2017-1000482, confirming this function's role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Products.CMFPlone | pip | < 4.3.17 | 4.3.17 |
| Products.CMFPlone | pip | >= 5.0.0, < 5.0.10 | 5.0.10 |
| Products.CMFPlone | pip | >= 5.1a1, < 5.1.0 | 5.1.0 |
| Plone | pip | >= 2.5a1, < 4.3.16 | 4.3.16 |
| Plone | pip | >= 5.0a1, < 5.1.0 | 5.1.0 |
PythonPythonOngoing coverage of React2Shell