CVE-2021-29002

Description

A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameter.

How to fix CVE-2021-29002

No fixed version has been published yet. Mitigate by removing the affected package or applying upstream guidance from the references below.

• PyPI/plone—no fix listed
• PyPI/plone—no fix listed

Is CVE-2021-29002 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, <= 5.2.3
• from 0, <= 5.2.3

CVSS scores

References (5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-29002
• PATCHgithub.com/plone/Plone
• WEBgithub.com/plone/Products.CMFPlone/issues/3255
• WEBgithub.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-889.yaml
• WEB