Bug 711495 (CVE-2011-1949)

Summary:	CVE-2011-1949 plone: A persistent cross site scripting vulnerability
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NEXTRELEASE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jonathansteffan, jpokorny, rmccabe, rsteiger
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-08-01 12:59:38 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	711497
Bug Blocks:	711503

Description Jan Lieskovsky 2011-06-07 16:20:06 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1949 to
the following vulnerability:

Cross-site scripting (XSS) vulnerability in the safe_html filter in
Products.PortalTransforms in Plone 2.1 through 4.1 allows remote
authenticated users to inject arbitrary web script or HTML via
unspecified vectors, a different vulnerability than CVE-2010-2422.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1949
[2] http://www.securityfocus.com/archive/1/archive/1/518155/100/0/threaded
[3] http://plone.org/products/plone/security/advisories/CVE-2011-1949
[4] http://www.securityfocus.com/bid/48005
[5] http://secunia.com/advisories/44775
[6] http://secunia.com/advisories/44776
[7] http://xforce.iss.net/xforce/xfdb/67694

Comment 1 Jan Lieskovsky 2011-06-07 16:20:59 UTC

This issue affects the version of the plone package, as present within EPEL-5
repository. Please schedule an update.

Comment 2 Jan Lieskovsky 2011-06-07 16:23:54 UTC

Created plone tracking bugs for this issue

Affects: epel-5 [bug 711497]

Comment 3 Huzaifa S. Sidhpurwala 2011-10-03 09:05:31 UTC

Statement:

This issue did not affect the versions of conga package as shipped with Red Hat Enterprise Linux 5 and with Red Hat Cluster Suite for Red Hat Enterprise Linux 4, as they did not include support for creation of new Plone content.