{"id":"CVE-2021-33926","aliases":["GHSA-47p5-p3jw-w78w","PYSEC-2023-289"],"url":"https://o3.security/vulnerability/CVE-2021-33926","summary":"Server-Side Request Forgery in Plone CMS","details":"An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet.","published":"2023-02-17T18:15:11.237Z","modified":"2026-07-08T05:57:08.768578938Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"PyPI","name":"plone","fixedVersion":"5.2.5"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://plone.org/security/hotfix/20210518"},{"type":"ADVISORY","url":"https://plone.org/security/hotfix/20210518/blind-ssrf-via-feedparser-accessing-an-internal-url"},{"type":"EVIDENCE","url":"https://github.com/s-kustm/Subodh/blob/master/Plone%205.2.4%20Vulnerable%20to%20bilend%20SSRF.pdf"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T05:57:08.768578938Z"}}