Red Hat Bugzilla – Bug 974654
conga (Plone): HTTP injection via benevolent cookie setting method triggered by malicious URL (accessed by authorized user)
Last modified: 2015-07-24 04:13:32 EDT
A HTTP injection flaw was found in the way Plone, a user friendly and powerful content management system, performed sanitization of HTTP cookie values provided within certain URL requests. A remote attacker could provide a specially-crafted URL that, then visited by an authenticated Plone user would lead to arbitrary HTML or web script execution in the context of the Plone user's session.
A different vulnerability than CVE-2012-5486.
This issue was discovered by Jan Pokorny of Red Hat.
This issue affects the version of the conga package, as shipped with Red Hat Enterprise Linux 5.
Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.