Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/56283?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/56283?format=api", "purl": "pkg:pypi/plone@2.5", "type": "pypi", "namespace": "", "name": "plone", "version": "2.5", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "5.2.5", "latest_non_vulnerable_version": "6.0.7", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7523?format=api", "vulnerability_id": "VCID-311f-xecp-47fm", "summary": "Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000483", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00294", "scoring_system": "epss", "scoring_elements": "0.52982", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000483" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-72.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-72.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20171128/sandbox-escape", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20171128/sandbox-escape" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000483", "reference_id": "CVE-2017-1000483", "reference_type": "", "scores": [ { "value": "6.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N" }, { "value": "7.1", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000483" }, { "reference_url": "https://github.com/advisories/GHSA-qc57-h2f7-p4hx", "reference_id": "GHSA-qc57-h2f7-p4hx", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-qc57-h2f7-p4hx" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8493?format=api", "purl": "pkg:pypi/plone@4.3.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.16" }, { "url": "http://public2.vulnerablecode.io/api/packages/9366?format=api", "purl": "pkg:pypi/plone@5.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0" } ], "aliases": [ "CVE-2017-1000483", "GHSA-qc57-h2f7-p4hx", "PYSEC-2018-72" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-311f-xecp-47fm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7524?format=api", "vulnerability_id": "VCID-fga8-ymex-67fw", "summary": "By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000484", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41478", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000484" }, { "reference_url": "https://github.com/advisories/GHSA-xvwv-6wvx-px9x", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-xvwv-6wvx-px9x" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/issues/2232", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/issues/2232" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-73.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-73.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000484", "reference_id": "CVE-2017-1000484", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000484" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8493?format=api", "purl": "pkg:pypi/plone@4.3.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.16" }, { "url": "http://public2.vulnerablecode.io/api/packages/9366?format=api", "purl": "pkg:pypi/plone@5.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0" } ], "aliases": [ "CVE-2017-1000484", "GHSA-xvwv-6wvx-px9x", "PYSEC-2018-73" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-fga8-ymex-67fw" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7017?format=api", "vulnerability_id": "VCID-gwqg-tne8-mbbt", "summary": "Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to \"an erroneous security declaration.\"", "references": [ { "reference_url": "http://plone.org/about/security/advisories/cve-2006-4247", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "8.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://plone.org/about/security/advisories/cve-2006-4247" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2006-4247", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00333", "scoring_system": "epss", "scoring_elements": "0.56368", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2006-4247" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "8.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-5.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "8.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-5.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4247", "reference_id": "CVE-2006-4247", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "8.0", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4247" }, { "reference_url": "https://github.com/advisories/GHSA-5hch-v5pq-x4qp", "reference_id": "GHSA-5hch-v5pq-x4qp", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-5hch-v5pq-x4qp" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/5611?format=api", "purl": "pkg:pypi/plone@2.5.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-k3e2-5fk3-cbfe" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@2.5.1" } ], "aliases": [ "CVE-2006-4247", "GHSA-5hch-v5pq-x4qp", "PYSEC-2006-5", "PYSEC-2006-9" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gwqg-tne8-mbbt" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7019?format=api", "vulnerability_id": "VCID-k3e2-5fk3-cbfe", "summary": "Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to \"masquerade as a group.\"", "references": [ { "reference_url": "http://plone.org/about/security/advisories/cve-2006-4249/", "reference_id": "", "reference_type": "", "scores": [], "url": "http://plone.org/about/security/advisories/cve-2006-4249/" }, { "reference_url": "http://plone.org/products/plone-hotfix/releases/20061031", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://plone.org/products/plone-hotfix/releases/20061031" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2006-4249", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00593", "scoring_system": "epss", "scoring_elements": "0.69591", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2006-4249" }, { "reference_url": "http://secunia.com/advisories/23240", "reference_id": "", "reference_type": "", "scores": [], "url": "http://secunia.com/advisories/23240" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30762", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30762" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-6.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-6.yaml" }, { "reference_url": "http://www.securityfocus.com/bid/21460", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/21460" }, { "reference_url": "http://www.vupen.com/english/advisories/2006/4878", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.vupen.com/english/advisories/2006/4878" }, { "reference_url": "http://plone.org/about/security/advisories/cve-2006-4249", "reference_id": "CVE-2006-4249", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://plone.org/about/security/advisories/cve-2006-4249" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4249", "reference_id": "CVE-2006-4249", "reference_type": "", "scores": [ { "value": "5.9", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "4.6", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-4249" }, { "reference_url": "https://github.com/advisories/GHSA-r7j4-82xw-8m9p", "reference_id": "GHSA-r7j4-82xw-8m9p", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-r7j4-82xw-8m9p" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/5613?format=api", "purl": "pkg:pypi/plone@2.5.2", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@2.5.2" } ], "aliases": [ "CVE-2006-4249", "GHSA-r7j4-82xw-8m9p", "PYSEC-2006-10", "PYSEC-2006-6" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-k3e2-5fk3-cbfe" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7023?format=api", "vulnerability_id": "VCID-x1d9-n4be-1yc3", "summary": "Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.", "references": [ { "reference_url": "http://osvdb.org/42071", "reference_id": "", "reference_type": "", "scores": [], "url": "http://osvdb.org/42071" }, { "reference_url": "http://osvdb.org/42072", "reference_id": "", "reference_type": "", "scores": [], "url": "http://osvdb.org/42072" }, { "reference_url": "http://plone.org/about/security/advisories/cve-2007-5741", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://plone.org/about/security/advisories/cve-2007-5741" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2007-5741", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0361", "scoring_system": "epss", "scoring_elements": "0.87983", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2007-5741" }, { "reference_url": "http://secunia.com/advisories/27530", "reference_id": "", "reference_type": "", "scores": [], "url": "http://secunia.com/advisories/27530" }, { "reference_url": "http://secunia.com/advisories/27559", "reference_id": "", "reference_type": "", "scores": [], "url": "http://secunia.com/advisories/27559" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38288", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38288" }, { "reference_url": "https://github.com/plone/Plone", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Plone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2007-4.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2007-4.yaml" }, { "reference_url": "https://web.archive.org/web/20080517012557/http://www.securityfocus.com/bid/26354", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20080517012557/http://www.securityfocus.com/bid/26354" }, { "reference_url": "https://web.archive.org/web/20080906150436/http://www.securityfocus.com/archive/1/483343/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20080906150436/http://www.securityfocus.com/archive/1/483343/100/0/threaded" }, { "reference_url": "http://www.debian.org/security/2007/dsa-1405", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.debian.org/security/2007/dsa-1405" }, { "reference_url": "http://www.securityfocus.com/archive/1/483343/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/archive/1/483343/100/0/threaded" }, { "reference_url": "http://www.securityfocus.com/bid/26354", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/26354" }, { "reference_url": "http://www.vupen.com/english/advisories/2007/3754", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.vupen.com/english/advisories/2007/3754" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5741", "reference_id": "CVE-2007-5741", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5741" }, { "reference_url": "https://web.archive.org/web/20080507055819/https://plone.org/about/security/advisories/cve-2007-5741", "reference_id": "CVE-2007-5741", "reference_type": "", "scores": [ { "value": "9.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" }, { "value": "9.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20080507055819/https://plone.org/about/security/advisories/cve-2007-5741" }, { "reference_url": "https://github.com/advisories/GHSA-hf26-vvmx-x8c8", "reference_id": "GHSA-hf26-vvmx-x8c8", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hf26-vvmx-x8c8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/5620?format=api", "purl": "pkg:pypi/plone@2.5.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@2.5.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/5621?format=api", "purl": "pkg:pypi/plone@3.0.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@3.0.3" } ], "aliases": [ "CVE-2007-5741", "GHSA-hf26-vvmx-x8c8", "PYSEC-2007-4" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-x1d9-n4be-1yc3" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/7521?format=api", "vulnerability_id": "VCID-y2bq-cb4v-mke6", "summary": "When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000481", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00197", "scoring_system": "epss", "scoring_elements": "0.41478", "published_at": "2026-05-30T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-1000481" }, { "reference_url": "https://github.com/plone/Products.CMFPlone", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/236b62b756ff46a92783b3897e717dfb15eb07d8" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/commit/7db5b2c8fb684055987b8c4fdedc29289bd26373" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/issues/2232", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/issues/2232" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2233", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2233" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2234", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2234" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2235", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2235" }, { "reference_url": "https://github.com/plone/Products.CMFPlone/pull/2236", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/plone/Products.CMFPlone/pull/2236" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-70.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-70.yaml" }, { "reference_url": "https://plone.org/security/hotfix/20171128/open-redirection-on-login-form", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://plone.org/security/hotfix/20171128/open-redirection-on-login-form" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000481", "reference_id": "CVE-2017-1000481", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000481" }, { "reference_url": "https://github.com/advisories/GHSA-8g72-gq68-6gqh", "reference_id": "GHSA-8g72-gq68-6gqh", "reference_type": "", "scores": [], "url": "https://github.com/advisories/GHSA-8g72-gq68-6gqh" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/8493?format=api", "purl": "pkg:pypi/plone@4.3.16", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5tbn-qmuj-jya9" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-fga8-ymex-67fw" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-gsnt-c1cd-d3bf" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-s5ab-nud4-5qdg" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@4.3.16" }, { "url": "http://public2.vulnerablecode.io/api/packages/9366?format=api", "purl": "pkg:pypi/plone@5.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2jxf-hfxq-skg7" }, { "vulnerability": "VCID-36xh-ua3s-gyfr" }, { "vulnerability": "VCID-3n34-5rm7-nbcj" }, { "vulnerability": "VCID-3s9q-6gvu-qyef" }, { "vulnerability": "VCID-5e2c-6mkx-4udu" }, { "vulnerability": "VCID-5z33-3pqj-gygw" }, { "vulnerability": "VCID-9ze6-mfrw-ukdv" }, { "vulnerability": "VCID-c3we-w4qc-6fhs" }, { "vulnerability": "VCID-d68e-uehc-nudc" }, { "vulnerability": "VCID-dnu9-u6zt-c7ch" }, { "vulnerability": "VCID-gejv-h449-13e4" }, { "vulnerability": "VCID-pv2n-2y41-pbg5" }, { "vulnerability": "VCID-r61f-p8nh-2bax" }, { "vulnerability": "VCID-r874-3h26-j3fp" }, { "vulnerability": "VCID-sa7x-wvn1-skh1" }, { "vulnerability": "VCID-tfmu-7tad-xbbe" }, { "vulnerability": "VCID-wage-1bme-bkgb" }, { "vulnerability": "VCID-z8kt-tf38-eqgc" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@5.1.0" } ], "aliases": [ "CVE-2017-1000481", "GHSA-8g72-gq68-6gqh", "PYSEC-2018-70" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-y2bq-cb4v-mke6" } ], "fixing_vulnerabilities": [], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/plone@2.5" }