CVE-2020-28734

Vulnerability

Overview

CVE-2020-28734 is an XML External Entity (XXE) vulnerability in Plone, a content management system. The flaw exists in a feature that is explicitly restricted to users with the Manager role. The root cause is improper handling of XML input, allowing external entities to be processed without validation [1][2].

Exploitation

Conditions

Exploitation requires an authenticated user with the Manager role. The attacker must have access to a Plone feature that processes XML data. No additional privileges or network position beyond standard Manager access are needed. The attack complexity is low, as the vulnerable functionality is designed for administrative use [1][3].

Impact

A successful XXE attack can lead to disclosure of local files on the server, server-side request forgery (SSRF), or denial of service. The impact is limited to Manager-level users, but given the high privileges of that role, the consequences can be severe, including exposure of sensitive configuration or data [1][4].

Mitigation

The vulnerability is fixed in Plone version 5.2.3. Users running earlier versions should upgrade immediately. No workarounds are documented; the feature is intentionally Manager-only, so restricting Manager access is a partial mitigation but not a complete fix [2][3].