PYSEC-2020-248

At a glance

Published: 2020-12-30 19:15 UTC
Updated: 2026-07-13 16:43 UTC
CVE: CVE-2020-28736
Aliases: GHSA-2c8c-84w2-j38j, PYSEC-2026-2879, PYSEC-2026-2882, PYSEC-2026-2885, PYSEC-2026-735

Description

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

Affected packages

Package	Versions
PyPI · plone	introduced 0, fixed 5.2.3

References

https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt WEB
https://github.com/plone/Products.CMFPlone/issues/3209 REPORT
https://www.misakikata.com/codes/plone/python-en.html WEB
https://github.com/advisories/GHSA-2c8c-84w2-j38j ADVISORY

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — PyPA Advisory Database