CVE-2021-35959

Vulnerability

In Plone versions 5.0.0 through 5.2.4, the folder contents view does not sanitize the description field of folders, allowing a Contributor to inject arbitrary HTML or JavaScript. An Editor viewing the folder contents will trigger the stored XSS because the description is rendered without proper escaping [1][3].

Exploitation

An attacker with the Contributor role creates a folder and sets its description to include a malicious SCRIPT tag. When an Editor navigates to the folder contents view, the script executes in the context of the Editor's session. No additional user interaction beyond viewing the folder contents is required [1][3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the Editor's browser. This can lead to session hijacking, defacement, or theft of sensitive information within the Plone site. The attack is limited to the privilege level of the targeted Editor, who typically has broader permissions than a Contributor [1][3].

Mitigation

A fix is included in the hotfix package Products.PloneHotfix20210518 version 1.5, available from PyPI and the Plone security advisory page. The affected package plone.app.content is fixed in version 3.8.8, which will be included in Plone 5.2.5 (expected July 2021). Users should upgrade to the patched version or apply the hotfix [3].