GHSA-hc5c-r8m5-2gfh
plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait
GHSA-hc5c-r8m5-2gfh is a low vulnerability (CVSS 3.7) in plone-restapi, published September 21, 2023. No source lists public exploit code. Fixed in plone-restapi 8.43.3.
- Severity
- 3.7 LowCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
8.43.3plone-restapi +1 more
Description
Impact
There is a stored cross site scripting vulnerability for SVG images uploaded in user portraits.
Note that a page that uses an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an SVG image as user portrait, and then trick a user into following a link to this portrait.
Patches
A patch will be released in plone.restapi 8.43.3. This version is good for Plone 6.0, and for Plone 5.2 on Python 3.
In plone.restapi 7 or earlier there was no @portrait endpoint yet, so there is nothing to fix in that version. It is still vulnerable to this attack, and needs a fix in Zope 4. These two vulnerabilities share the same CVE: CVE-2023-42458.
Workarounds
You could remove the portrait field from the member data schema, and possibly remove all portraits that are already in the database, but this seems a bit drastic.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plone-restapiPyPI | 8.0.0 up to 8.43.3 | 8.43.3 |
plone-restapiPyPI | 8.0.0 up to 8.43.3, plus listed versions 8.1.08.10.08.11.08.12.08.12.1 Show 45 moreShow less8.13.08.14.08.15.08.15.18.15.28.15.38.16.08.16.18.16.28.17.08.18.08.18.18.19.08.2.08.20.08.21.08.21.18.21.28.22.08.23.08.24.08.24.18.25.08.25.18.26.08.27.08.28.08.29.08.3.08.3.18.3.28.30.08.30.1.dev08.31.08.32.08.32.18.32.28.32.38.32.48.32.4.dev08.32.58.32.68.33.08.33.18.33.2 | 8.43.3 |
What each source reports
GitHub Advisories Score used
plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait
Impact
There is a stored cross site scripting vulnerability for SVG images uploaded in user portraits.
Note that a page that uses an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an SVG image as user portrait, and then trick a user into following a link to this portrait.
Patches
A patch will be released in plone.restapi 8.43.3. This version is good for Plone 6.0, and for Plone 5.2 on Python 3.
In plone.restapi 7 or earlier there was no @portrait endpoint yet, so there is nothing to fix in that version. It is still vulnerable to this attack, and needs a fix in Zope 4. These two vulnerabilities share the same CVE: CVE-2023-42458.
Workarounds
You could remove the portrait field from the member data schema, and possibly remove all portraits that are already in the database, but this seems a bit drastic.
- Record
GHSA-hc5c-r8m5-2gfh- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSV
plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait
Impact
There is a stored cross site scripting vulnerability for SVG images uploaded in user portraits.
Note that a page that uses an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an SVG image as user portrait, and then trick a user into following a link to this portrait.
Patches
A patch will be released in plone.restapi 8.43.3. This version is good for Plone 6.0, and for Plone 5.2 on Python 3.
In plone.restapi 7 or earlier there was no @portrait endpoint yet, so there is nothing to fix in that version. It is still vulnerable to this attack, and needs a fix in Zope 4. These two vulnerabilities share the same CVE: CVE-2023-42458.
Workarounds
You could remove the portrait field from the member data schema, and possibly remove all portraits that are already in the database, but this seems a bit drastic.
- Record
GHSA-hc5c-r8m5-2gfh- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 33 versions. The JSON record has them.