{"id":"CVE-2015-7316","published":"2017-09-25T17:00:00Z","modified":"2024-08-06T07:43:46Z","title":"Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6…","vendor":null,"product":null,"tier":"tail","description":{"text":"Cross-site scripting (XSS) vulnerability in Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.x before 4.3.7, and 5.0rc1.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01417,"percentile":0.72704,"provenance":"source"},"cwes":[],"references":[{"url":"http://www.openwall.com/lists/oss-security/2015/09/22/14","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1264788","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087","tags":["x_refsource_MISC"]},{"url":"https://plone.org/security/hotfix/20150910/non-persistent-xss-in-plone","tags":["x_refsource_CONFIRM"]}],"priority":{"score":14.5,"factors":[{"name":"EPSS percentile","points":14.54}]},"affected":[{"ecosystem":"PyPI","package":"Plone","vulnerableRanges":[">=3.3, <3.3.7",">=4.0, <4.0.11",">=4.1, <4.1.7",">=4.2, <4.2.8",">=4.3, <4.3.7",">=3.3, <4.0a1",">=4.0, <4.1a1",">=4.1, <4.2a1",">=4.2, <4.3a1",">=5.0a1, <5.0rc2"],"patched":["3.3.7","4.0.11","4.1.7","4.2.8","4.3.7","4.0a1","4.1a1","4.2a1","4.3a1","5.0rc2"],"from":["GHSA-vf8g-m3vq-6p4p","PYSEC-2017-53"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0086","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-products-cmfplone-cve-2015-7315","children":[{"from":"CVE-2015-7316","to":"CVE-2015-7315","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Plone","fromFixed":"4.0.11","toFixed":"4.1a1","daysApart":0},{"kind":"same-code","provenance":"machine","files":["Products/CMFPlone/URLTool.py"],"commits":["https://github.com/plone/Products.CMFPlone/commit/1845b0a92312291811b68907bf2aa0fb448c4016","https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087"],"basis":"shared function","functions":["isURLInPortal"]},{"kind":"similar","provenance":"machine","score":0.34,"basis":"same package + description similarity"}]},{"from":"CVE-2015-7316","to":"CVE-2017-1000481","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["Products/CMFPlone/URLTool.py"],"commits":["https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087","https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab","https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b"],"basis":"shared function","functions":["isURLInPortal"]}]},{"from":"CVE-2015-7316","to":"CVE-2017-1000482","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["Products/CMFPlone/URLTool.py"],"commits":["https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087","https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab","https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b"],"basis":"shared function","functions":["isURLInPortal"]}]}],"packageHistory":[{"cve":"CVE-2013-7061","published":"2014-05-02","fixed":"4.3.3","kev":false},{"cve":"CVE-2013-7062","published":"2020-01-02","fixed":"4.3.3","kev":false},{"cve":"CVE-2015-7315","published":"2017-09-25","fixed":"4.3.7","kev":false},{"cve":"CVE-2015-7316","published":"2017-09-25","fixed":"5.0rc2","kev":false},{"cve":"CVE-2015-7293","published":"2017-09-25","fixed":"5.0a1","kev":false,"link":{"from":"CVE-2015-7316","to":"CVE-2015-7293","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Plone","fromFixed":"5.0rc2","toFixed":"5.0a1","daysApart":0}]}},{"cve":"CVE-2016-7135","published":"2017-03-07","fixed":"5.0.7","kev":false},{"cve":"CVE-2016-7136","published":"2017-03-07","fixed":"5.0.7","kev":false}],"package":"PyPI:Plone"}}