CVE-2013-7062 in Plone

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Reservation

12/11/2013

Status

Confirmed

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
11478	Plone Session BrowserIdManager.py Reflected cross site scripting	80	Proof-of-Concept	Official fix	CVE-2013-7062
11477	Plone Image Tag Image.py Reflected cross site scripting	80	Proof-of-Concept	Official fix	CVE-2013-7062

Sources

• MITRE
• NVD
• CVE Details