CVE-2013-7062
Last modified
CVE-2013-7062 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method.. EPSS estimates a 1.40% chance of exploitation in the next 30 days.
Description
Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Plone | Plone | >= 3.3.0, <= 3.3.6 |
| Plone | Plone | >= 4.0.0, <= 4.0.9 |
| Plone | Plone | >= 4.1.0, <= 4.1.6 |
| Plone | Plone | >= 4.2.0, <= 4.2.7 |
| Plone | Plone | >= 4.3.0, <= 4.3.2 |
References
- http://seclists.org/oss-sec/2013/q4/467Mailing List, Third Party Advisory
- http://seclists.org/oss-sec/2013/q4/485Mailing List, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89623Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89627Third Party Advisory, VDB Entry
- https://plone.org/security/20131210/zope-xss-in-OFSVendor Advisory
- http://seclists.org/oss-sec/2013/q4/467Mailing List, Third Party Advisory
- http://seclists.org/oss-sec/2013/q4/485Mailing List, Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89623Third Party Advisory, VDB Entry
- https://exchange.xforce.ibmcloud.com/vulnerabilities/89627Third Party Advisory, VDB Entry
- https://plone.org/security/20131210/zope-xss-in-OFSVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-7062?
How severe is CVE-2013-7062?
How do I fix CVE-2013-7062?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-7053D-Link DIR-100 4.03B07: cli.cgi CSRF8.8
- CVE-2013-7054D-Link DIR-100 4.03B07: cli.cgi XSS6.1
- CVE-2013-7055D-Link DIR-100 4.03B07 has PPTP and poe information disclosu…9.8
- CVE-2013-7057Cross-site request forgery (CSRF) vulnerability in Axway Sec…
- CVE-2013-7060Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 …
- CVE-2013-7061Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 …
- CVE-2013-7063The Invitation module 7.x-2.x for Drupal does not properly c…
- CVE-2013-7064Cross-site scripting (XSS) vulnerability in the EU Cookie Co…
- CVE-2013-7065The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Dr…
- CVE-2013-7066The Entity reference module 7.x-1.x before 7.x-1.1-rc1 for D…
- CVE-2013-7067The OG Features module 6.x-1.x before 6.x-1.4 for Drupal doe…
- CVE-2013-7068The Organic Groups (OG) module 7.x-2.x before 7.x-2.3 for Dr…
Are you affected by CVE-2013-7062?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST