Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-28734

CVE-2020-28734:
Improper Restriction of XML External Entity Reference in Plone

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-28734
GHSA ID
GHSA-wq6x-g685-w5f2
EPSS Score
0.64346%
CWE
CWE-611
Published
4/7/2021
Updated
10/17/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
Plonepip< 5.2.35.2.3
plone.app.eventpip< 3.2.103.2.10
plone.app.themingpip< 4.1.64.1.6
plone.app.dexteritypip< 2.6.82.6.8
plone.supermodelpip< 1.6.31.6.3

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability centers on XML processing in privileged Manager-facing features across multiple Plone components. Analysis of affected packages (plone.supermodel, plone.app.theming, plone.app.event) reveals XML parsing is a common thread. The CWE-611 pattern matches insecure XML handling without entity restrictions. Release notes specifically mention XML/ical fixes for Manager-accessible features. While exact patch diffs aren't shown, Plone's architecture and standard XXE mitigation patterns (adding resolve_entities=False) indicate these core XML processing functions would be attack vectors. Functions were selected based on their role in processing user-controlled XML in privileged contexts.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Plon* ***or* *.*.* *llows XX* *tt**ks vi* * ***tur* t**t is *xpli*itly only *v*il**l* to t** M*n***r rol*.

Reasoning

T** vuln*r**ility **nt*rs on XML pro**ssin* in privil**** M*n***r-***in* ***tur*s **ross multipl* Plon* *ompon*nts. *n*lysis o* *****t** p**k***s (`plon*.sup*rmo**l`, `plon*.*pp.t**min*`, `plon*.*pp.*v*nt`) r*v**ls XML p*rsin* is * *ommon t*r***. T**