CVE-2020-28736

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

Published: Dec 30, 2020
Updated: May 9, 2024
CVE: CVE-2020-28736
GHSA: GHSA-2c8c-84w2-j38j
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.5
AV:N/AC:L/Au:S/C:P/I:P/A:P

CWEs:

CWE-611

OWASP TOP 10:

A4 - XML External Entities (XXE)

Affected Software
References

Software	From	Fixed in
plone / plone	-	5.2.3
plone	-	5.2.3
plone.app.event	-	3.2.10
plone.app.theming	-	4.1.6
plone.app.dexterity	-	2.6.8
plone.supermodel	-	1.6.3

https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
https://github.com/plone/Products.CMFPlone/issues/3209
https://www.misakikata.com/codes/plone/python-en.html

Vulnerability Database

CVE-2020-28736

Deep Security Visibility Without the Complexity