vendor:
Zope Management Interface 4.3.7, Zope, Plone
by:
hyp3rlinx
7,8
CVSS
HIGH
Cross site request forgery (CSRF)
352
CWE
Product Name: Zope Management Interface 4.3.7, Zope, Plone
Affected Version From: 4.3.7
Affected Version To: 3.3
Patch Exists: YES
Related CWE: NA
CPE: a:zope:zope_management_interface
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: None
2015
Plone CSRF Add Linxs & Persistent XSS
Multiple CSRF (cross-site request forgery) vulnerabilities in the ZMI (Zope Management Interface). Patches to Zope and Plone for multiple CSRF issues.
Mitigation:
Nathan Van Gheem, of the Plone Security Team Coordinated by Plone Security Team patch was released and is available from https://pypi.python.org/pypi/plone4.csrffixes