Unscored severity · published Oct 15, 2008
CVE-2008-4571
Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field…
–
CVSS
1.2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the LiveSearch module in Plone before 3.0.4 allows remote attackers to inject arbitrary web script or HTML via the Description field for search results, as demonstrated using the onerror Javascript even in an IMG tag.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
Plone · Plone
through 3.0.3; 2.0.5; 2.1.2; 2.5; 2.5.1; 2.5.1_rc; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-4571
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-4571
Exploit
http://dev.plone.org/plone/ticket/7439
osvdb.org
http://osvdb.org/40660
Patch
http://plone.org/products/plone/releases/3.0.4
Vendor Advisory
http://secunia.com/advisories/28293
Patch
http://www.securityfocus.com/bid/27098
More from Plone
9.9
CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script
9.8
CVE-2020-35190
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user
9.8
CVE-2020-7941
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission
8.8
CVE-2021-33926
An issue in Plone CMS v
8.8
CVE-2021-32633
Zope is an open-source web application server