Plone vulnerabilities

2 known vulnerabilities in Plone from Plone. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Plone: Incorrect Default Permissions

  CVE-2024-22889Mar 6, 2024Plone

  Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.

• 7.1 High severity

  Plone CMS: Improper Restriction of Rendered UI Layers or Frames

  CVE-2024-0669Jan 18, 2024Plone CMS

  A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting verssion below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.