NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐍
🐍 PyPI
Not in CISA KEV
LOW severity

plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portraitGHSA-hc5c-r8m5-2gfh

LOWFix: plone/plone.restapi@5f44c23

GHSA-hc5c-r8m5-2gfh is a low-severity (CVSS 3.7) vulnerability in plone-restapi. A fix is available for plone-restapi — see the affected versions and patch details below.

Published
Updated
Affected
1 pkg
Patched
1 / 1
Exploits
None indexed
Exploitation data as of Dec 4, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected
🐍plone-restapi

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects PyPI packages — download data is not available via public APIs for these ecosystems.

Description

Impact

There is a stored cross site scripting vulnerability for SVG images uploaded in user portraits.

Note that a page that uses an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an SVG image as user portrait, and then trick a user into following a link to this portrait.

Patches

A patch will be released in plone.restapi 8.43.3. This version is good for Plone 6.0, and for Plone 5.2 on Python 3.

In plone.restapi 7 or earlier there was no @portrait endpoint yet, so there is nothing to fix in that version. It is still vulnerable to this attack, and needs a fix in Zope 4. These two vulnerabilities share the same CVE: CVE-2023-42458.

Workarounds

You could remove the portrait field from the member data schema, and possibly remove all portraits that are already in the database, but this seems a bit drastic.

Affected Packages

1 total 1 fixed
EcosystemPackageVulnerable rangeFix
🐍PyPIplone-restapi≥ 8.0.0&&< 8.43.38.43.3pip install --upgrade 'plone-restapi==8.43.3'

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for plone-restapi, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update plone-restapi to 8.43.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-hc5c-r8m5-2gfh is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Impact There is a stored cross site scripting vulnerability for SVG images uploaded in user portraits. Note that a page that uses an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an SVG image as user portrait, and then trick a user into following a link to this portrait. ### Patches A patch will be released in `plone.restapi` 8.43.3. This version is good for Plone 6.0, and for Plone 5.2 on Python 3. In `plone.restapi` 7 or earlier there was no `@portrait` en
O3 Security · Impact-Aware SCA

Is GHSA-hc5c-r8m5-2gfh in your dependencies?

Find it across PyPI, including transitive dependencies.

Scan my dependencies How O3 SCA works
plone.restapi vulnerable to Stored Cross Site Scripting…