CyberRota Analysis
AI-GeneratedThe vulnerability exists in the RichText field type of the plone.app.textfield package, where unsanitized HTML content can be returned when the mimeType matches the outputMimeType, allowing for potential cross-site scripting (XSS) attacks. This flaw can be exploited by users who can input content into the RichText field, leading to the execution of malicious JavaScript in the browsers of viewers. Organizations using affected versions should prioritize upgrading to versions 2.0.2, 3.0.2, or 4.0.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
plone.app.textfield provides a zope.schema-style field type called RichText for storing a value with a related MIME type. Prior to 2.0.2, 3.0.2, and 4.0.1, depending on the release line, RichTextValue.output returns an unsanitized stored RichText value when mimeType equals outputMimeType, including values that claim the text/x-html-safe output type. This equality shortcut bypasses the safe_html transform even though the transform itself correctly removes event-handler attributes and unsafe URI schemes. Equal types can result from a RichText field configured with the same mimeType and outputMimeType or from REST API input that supplies text/x-html-safe as its content type. The raw stored value is then emitted through tal:content=structure without escaping, allowing a user who can set a RichText field to store JavaScript that executes in a viewer's browser. This issue is fixed in versions 2.0.2, 3.0.2, and 4.0.1.