Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2422 to the following vulnerability: Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to inject arbitrary web script or HTML via the safe_html transform. References: [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2422 [2] http://plone.org/products/plone/security/advisories/cve-2010-unassigned-html-injection-in-safe_html [3] http://www.securityfocus.com/bid/40999 [4] http://secunia.com/advisories/40270
This issue affects the versions of the conga package, as shipped with Red Hat Cluster Suite for Red Hat Enterprise Linux 4 and with Red Hat Cluster Suite for Red Hat Enterprise Linux 5. This issue affects the version of the plone package, as present within Extra Packages for Enterprise Linux 5 (EPEL-5) repository.
(In reply to comment #1) > This issue affects the versions of the conga package, as shipped > with Red Hat Cluster Suite for Red Hat Enterprise Linux 4 and > with Red Hat Cluster Suite for Red Hat Enterprise Linux 5. As the Luci application does not expose this flaw, and does not allow users to create new content and rather limits them to per-made web application, there's no plan to fix this issue in Cluster Suite conga / luci packages.