Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/26508?format=api",
    "purl": "pkg:pypi/products-atcontenttypes@2.0",
    "type": "pypi",
    "namespace": "",
    "name": "products-atcontenttypes",
    "version": "2.0",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": true,
    "next_non_vulnerable_version": "3.0.6",
    "latest_non_vulnerable_version": "3.0.6",
    "affected_by_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/35973?format=api",
            "vulnerability_id": "VCID-phf3-f5cb-xkfs",
            "summary": "Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user's cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.",
            "references": [
                {
                    "reference_url": "https://github.com/plone/Products.ATContentTypes",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/plone/Products.ATContentTypes"
                },
                {
                    "reference_url": "https://github.com/plone/Products.ATContentTypes/commit/fc793f88f35a15a68b52e4abed77af0da5fdbab8",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/plone/Products.ATContentTypes/commit/fc793f88f35a15a68b52e4abed77af0da5fdbab8"
                },
                {
                    "reference_url": "https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh"
                },
                {
                    "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/products-atcontenttypes/PYSEC-2022-21.yaml",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/pypa/advisory-database/tree/main/vulns/products-atcontenttypes/PYSEC-2022-21.yaml"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23599",
                    "reference_id": "CVE-2022-23599",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-23599"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-g4c2-ghfg-g5rh",
                    "reference_id": "GHSA-g4c2-ghfg-g5rh",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-g4c2-ghfg-g5rh"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/26567?format=api",
                    "purl": "pkg:pypi/products-atcontenttypes@3.0.6",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/products-atcontenttypes@3.0.6"
                }
            ],
            "aliases": [
                "CVE-2022-23599",
                "GHSA-g4c2-ghfg-g5rh",
                "PYSEC-2022-21"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-phf3-f5cb-xkfs"
        }
    ],
    "fixing_vulnerabilities": [],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/products-atcontenttypes@2.0"
}