CVE-2012-5494

Cross-site scripting (XSS) in Plone (before 4.2.3 and 4.3 beta 1)

• CVSS 4.3
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• Configuration Issues
• Remote

Cross-site scripting (XSS) vulnerability in python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to "{u,}translate."

CVE

CVE-2012-5494

CWE

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS base score

4.3

Published

2014-09-30

OWASP

A04 Insecure Design

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Configuration Issues

Subcategory

Cross-Site Scripting (XSS)

Accessibility scope

Remote

Impact

Arbitrary Code Execution

Fixed by upgrading

Yes

Solution

Update to Plone version 4.2.3 or higher

def render(title):
    """Vulnerable function that demonstrates the security issue."""
    return f"<div>{title}</div>"

user_input = "<script>alert('XSS');</script>"
output = render(user_input)
print(output)

import html

def render(title):
    """Secure function that fixes the vulnerability."""
    return f"<div>{html.escape(title)}</div>"

user_input = "<script>alert('XSS');</script>"
output = render(user_input)
print(output)

@misc{vaitp:cve20125494,
  title        = {{Cross-site scripting (XSS) in Plone (before 4.2.3 and 4.3 beta 1)}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2014},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2012-5494},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2012-5494/}}
}