CVE-2020-28736
Fixed upstream EPSS 1%
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).
Products: plone
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | plone | 5.2.3 |
| PyPI | plone-app-dexterity | 2.6.8 |
| PyPI | plone-app-event | 3.2.10 |
| PyPI | plone-app-theming | 4.1.6 |
| PyPI | plone-supermodel | 1.6.3 |