{"id":"CVE-2017-1000482","published":"2018-01-03T18:00:00Z","modified":"2024-09-16T23:16:28Z","title":"A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this…","vendor":null,"product":null,"tier":"tail","description":{"text":"A member of the Plone 2.5-5.1rc1 site could set javascript in the home_page property of his profile, and have this executed when a visitor click the home page link on the author page.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00565,"percentile":0.46837,"provenance":"source"},"cwes":[],"references":[{"url":"https://plone.org/security/hotfix/20171128/xss-using-the-home_page-member-property","tags":["x_refsource_MISC"]}],"priority":{"score":9.4,"factors":[{"name":"EPSS percentile","points":9.37}]},"affected":[{"ecosystem":"PyPI","package":"Products.CMFPlone","vulnerableRanges":["<4.3.17",">=5.0.0, <5.0.10",">=5.1a1, <5.1.0"],"patched":["4.3.17","5.0.10","5.1.0"],"from":["GHSA-859j-668v-mrr6","PYSEC-2026-2962"],"provenance":"source"},{"ecosystem":"PyPI","package":"Plone","vulnerableRanges":[">=2.5a1, <4.3.16",">=5.0a1, <5.1.0",">=2.5, <4.3.16",">=5, <5.1.0"],"patched":["4.3.16","5.1.0"],"from":["GHSA-859j-668v-mrr6","PYSEC-2018-71"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0114","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-products-cmfplone-cve-2015-7315","parents":[{"from":"CVE-2015-7315","to":"CVE-2017-1000482","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Products.CMFPlone","fromFixed":"4.3.7","toFixed":"4.3.17","daysApart":100},{"kind":"same-code","provenance":"machine","files":["Products/CMFPlone/URLTool.py"],"commits":["https://github.com/plone/Products.CMFPlone/commit/1845b0a92312291811b68907bf2aa0fb448c4016","https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab","https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b"],"basis":"shared function","functions":["isURLInPortal"]}]},{"from":"CVE-2015-7316","to":"CVE-2017-1000482","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["Products/CMFPlone/URLTool.py"],"commits":["https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087","https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab","https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b"],"basis":"shared function","functions":["isURLInPortal"]}]}],"packageHistory":[{"cve":"CVE-2013-7061","published":"2014-05-02","fixed":"4.3.3","kev":false},{"cve":"CVE-2015-7315","published":"2017-09-25","fixed":"5.0rc2","kev":false},{"cve":"CVE-2017-1000481","published":"2018-01-03","fixed":"5.1.0","kev":false},{"cve":"CVE-2017-1000482","published":"2018-01-03","fixed":"5.1.0","kev":false}],"package":"PyPI:Products.CMFPlone"}}