Bug 608098 (CVE-2010-2422)

Summary:	CVE-2010-2422 Plone: Cross-site scripting (XSS) vulnerability in PortalTransforms
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	cluster-maint, edamato, jonathansteffan, jpokorny, kanderso, rmccabe
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-07-29 15:11:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2010-06-25 16:36:16 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2422 to
the following vulnerability:

Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone
2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to
inject arbitrary web script or HTML via the safe_html transform.

References:
  [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2422
  [2] http://plone.org/products/plone/security/advisories/cve-2010-unassigned-html-injection-in-safe_html
  [3] http://www.securityfocus.com/bid/40999
  [4] http://secunia.com/advisories/40270

Comment 1 Jan Lieskovsky 2010-06-25 16:52:27 UTC

This issue affects the versions of the conga package, as shipped
with Red Hat Cluster Suite for Red Hat Enterprise Linux 4 and 
with Red Hat Cluster Suite for Red Hat Enterprise Linux 5.

This issue affects the version of the plone package, as present
within Extra Packages for Enterprise Linux 5 (EPEL-5) repository.

Comment 4 Tomas Hoger 2010-09-09 10:53:49 UTC

(In reply to comment #1)
> This issue affects the versions of the conga package, as shipped
> with Red Hat Cluster Suite for Red Hat Enterprise Linux 4 and 
> with Red Hat Cluster Suite for Red Hat Enterprise Linux 5.

As the Luci application does not expose this flaw, and does not allow users to create new content and rather limits them to per-made web application, there's no plan to fix this issue in Cluster Suite conga / luci packages.