CVE-2020-28736

Vulnerability

Overview

CVE-2020-28736 describes an XML External Entity (XXE) vulnerability in Plone, a content management system, affecting versions before 5.2.3. The flaw resides in a feature protected by the plone.schemaeditor.ManageSchemata permission, which is unapplied in the default configuration, meaning only users with the Manager role can access it [1][2]. The root cause is improper handling of XML input within this feature, allowing external entity injection.

Exploitation

To exploit this vulnerability, an attacker must already possess the Manager role in the Plone instance. With that privilege, they can craft malicious XML data that includes references to external entities. When processed by the vulnerable schema editor, the XML parser resolves these entities, leading to XXE [1][3]. No other authentication or network position is required beyond Manager access.

Impact

Successful exploitation can result in information disclosure, server-side request forgery (SSRF), or denial of service, depending on the capabilities of the XML parser and the server environment [2][4]. The CVSS score is not yet provided by NVD, but the GitHub Advisory notes high severity due to the potential for sensitive data exposure.

Mitigation

The vulnerability is fixed in Plone version 5.2.3 and later. Users running earlier versions should upgrade immediately. No workarounds are documented, and the feature is only accessible to Managers, which limits the attack surface but does not eliminate the risk if Manager accounts are compromised [1][4].