Cross-Frame Scripting (XFS) on Plone CMS

CVE-2024-0669 is a Cross-Frame Scripting (XFS) vulnerability affecting Plone CMS versions below 6.0.5. The vulnerability is classified under CWE-1021 and has a CVSS v3.1 base score of 6.3 [3]. The root cause is improper restriction of frame or iframe execution, allowing an attacker to inject a malicious iframe via a stored URL.

To exploit this vulnerability, an attacker must have low privileges and store a malicious URL that later requires an administrator to open it. The attack vector is network-based with low complexity, and no user interaction beyond the administrator opening the link is required [3].

Successful exploitation allows an attacker to execute a malicious iframe, leading to limited impacts on confidentiality, integrity, and availability [3].

The issue has been addressed by the vendor in Plone CMS version 6.0.7. Users are advised to update to this or later versions to mitigate the risk [3].