plone.app.event Denial of Service and Stored XSS Vulnerability
- Severity
- HIGH
- Affected component
- plone.app.event (pypi)
- Affected versions
- < 5.2.4 or >= 6.0.0a1, < 6.0.1
- Patched version
- 6.0.1 || 5.2.4
The plone.app.event package is reportedly vulnerable to denial of service and stored XSS via iCalendar import. A logged-in editor could take the whole site offline and read calendar files off disk.
What happened
The plone.app.event package, used in Plone content management systems, is under investigation for a high-severity vulnerability. This vulnerability, tracked as GHSA-R82H-MQW3-FC56, allows a denial of service and stored XSS attack via iCalendar import. An authenticated editor could exploit this to take the entire site offline and access calendar files stored on disk. The vulnerability has not been exploited in the wild as of the latest reports.
Affected versions include those below 5.2.4 and any versions from 6.0.0a1 up to but not including 6.0.1. The recommended action is to upgrade to plone.app.event 6.0.1 for Plone 6.2 or 5.2.4 for Plone 6.1 and 6.0. This upgrade is crucial for mitigating the risk of the reported vulnerabilities.
What to do about it
- Identify and list all instances where plone.app.event is used in your environment.
- Check the current versions of plone.app.event in use against the affected version ranges: below 5.2.4 and from 6.0.0a1 up to but not including 6.0.1.
- Upgrade to plone.app.event 6.0.1 for Plone 6.2 or 5.2.4 for Plone 6.1 and 6.0 to mitigate the risk.
- Monitor the primary sources for updates on the vulnerability and any further recommended actions.
- Consider implementing additional security measures to protect against potential denial of service and XSS attacks.
How 0Day would have caught this
plone.app.event is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using plone.app.event in versions below 5.2.4 or from 6.0.0a1 up to but not including 6.0.1.
What should I do right now?
Upgrade to plone.app.event 6.0.1 for Plone 6.2 or 5.2.4 for Plone 6.1 and 6.0.
Has this been exploited in the wild?
No, there are no reports of this vulnerability being exploited in the wild as of the latest information.