Vulnerability Name:

CVE-2011-1948 (CCN-67693)

Assigned:2011-05-31
Published:2011-05-31
Updated:2023-02-13
Summary:Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: CCN
Type: BugTraq Mailing List, Thu May 26 2011 - 09:06:06 CDT
[CVE-REQUEST] Plone XSS and permission errors

Source: MITRE
Type: CNA
CVE-2011-1948

Source: CCN
Type: Plone Web site
Security vulnerability announcement: CVE-2011-1948 – A reflected cross site scripting vulnerability

Source: secalert@redhat.com
Type: Patch, Vendor Advisory
secalert@redhat.com

Source: CCN
Type: RHSA-2012-0151
Moderate: conga security, bug fix, and enhancement update

Source: CCN
Type: SA44775
Plone Multiple Vulnerabilities

Source: CCN
Type: SA44776
Plone Cross-Site Scripting and Script Insertion Vulnerabilities

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: OSVDB ID: 72727
Plone Unspecified XSS

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: CCN
Type: BID-48005
Plone Multiple Security Vulnerabilities

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: secalert@redhat.com
Type: UNKNOWN
secalert@redhat.com

Source: XF
Type: UNKNOWN
plone-unspec-xss(67693)

Vulnerable Configuration:Configuration RedHat 1:
  • cpe:/a:redhat:rhel_cluster:5:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:plone:plone:2.5_beta1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5.1_rc:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:2.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.2:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.1:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:3.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:plone:plone:4.0:*:*:*:*:*:*:*
  • AND
  • cpe:/a:redhat:rhel_cluster:5:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:27671
    P
    		ELSA-2012-0151 -- conga security, bug fix, and enhancement update (moderate)
    2014-12-15
    oval:com.redhat.rhsa:def:20120151
    P
    		RHSA-2012:0151: conga security, bug fix, and enhancement update (Moderate)
    2012-02-21
    BACK
    plone plone 2.5_beta1
    plone plone 2.5.1
    plone plone 2.5
    plone plone 2.5.1_rc
    plone plone 2.5.2
    plone plone 2.5.3
    plone plone 2.5.4
    plone plone 3.0
    plone plone 3.0.1
    plone plone 3.0.2
    plone plone 3.0.3
    plone plone 3.0.5
    plone plone 3.0.4
    plone plone 3.2
    plone plone 3.1
    plone plone 3.3.3
    plone plone 4.0
    redhat rhel cluster 5