CVE-2021-33513

Vulnerability

The vulnerability is a cross-site scripting (XSS) issue in the inline_diff methods of the Products.CMFDiffTool module in Plone CMS. Affected versions include all supported Plone versions up to 5.2.4 and earlier 4.3.x releases [1][3]. The flaw allows an attacker to inject malicious scripts that are executed when a user views a diff comparison.

Exploitation

An attacker with the ability to create or modify content (e.g., a contributor or editor) can inject malicious HTML/JavaScript into content fields that are later compared using the inline diff functionality. When an administrator or other user views the diff, the injected script executes in their browser session. No special network position is required beyond standard web access.

Impact

Successful exploitation leads to arbitrary JavaScript execution in the context of the victim's session. This can result in session hijacking, defacement, or theft of sensitive information. The attacker gains the same privileges as the victim user, potentially escalating to full administrative control if the victim is an administrator.

Mitigation

Plone released a security hotfix on May 18, 2021 (hotfix 20210518) that addresses this vulnerability [3]. Users should apply the hotfix immediately. No workaround is available for unpatched versions. The vulnerability affects all supported Plone versions; earlier unsupported versions may also be vulnerable but the hotfix has not been tested on them [3].