Read the docs
TI-2021-13226 Aliases CVE-2021-33926GHSA-47p5-p3jw-w78w

An issue in Plone CMS v.

Priority HIGH 73CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub.

Summary

An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, 5.1rc2, 5.1rc1, 5.1b4, 5.1b3, 5.1b2, 5.1a2, 5.1a1, 5.1.7, 5.1.6, 5.1.5, 5.1.4, 5.1.2, 5.1.1 5.1, 5.0rc3, 5.0rc2, 5.0rc1, 5.0.9, 5.0.8, 5.0.7, 5.0.6, 5.0.5, 5.0.4, 5.0.3, 5.0.2, 5.0.10, 5.0.1, 5.0, 4.3.9, 4.3.8, 4.3.7, 4.3.6, 4.3.5, 4.3.4, 4.3.3, 4.3.20, 4 allows attacker to access sensitive information via the RSS feed protlet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01013 63rd percentileScored 2026-11-08
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Plone (PyPI): 5.2.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Plone (PyPI)4.3 to before 5.2.55.2.5Patch availableGHSA-47p5-p3jw-w78w
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Plone (PyPI) Vendor— Affected 4.3 to before 5.2.5 Fixed in 5.2.5 Patch available GHSA-47p5-p3jw-w78w

CPE configurations NVD · 52

CPEVersionsRoleVendor
cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*4.3Vulnerableplone
cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:*4.3.1Vulnerableplone
cpe:2.3:a:plone:plone:4.3.2:*:*:*:*:*:*:*4.3.2Vulnerableplone
cpe:2.3:a:plone:plone:4.3.3:*:*:*:*:*:*:*4.3.3Vulnerableplone
cpe:2.3:a:plone:plone:4.3.4:*:*:*:*:*:*:*4.3.4Vulnerableplone
cpe:2.3:a:plone:plone:4.3.5:*:*:*:*:*:*:*4.3.5Vulnerableplone
cpe:2.3:a:plone:plone:4.3.6:*:*:*:*:*:*:*4.3.6Vulnerableplone
cpe:2.3:a:plone:plone:4.3.7:*:*:*:*:*:*:*4.3.7Vulnerableplone
cpe:2.3:a:plone:plone:4.3.8:*:*:*:*:*:*:*4.3.8Vulnerableplone
cpe:2.3:a:plone:plone:4.3.9:*:*:*:*:*:*:*4.3.9Vulnerableplone
  • cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.2:*:*:*:*:*:*:* Versions 4.3.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.3:*:*:*:*:*:*:* Versions 4.3.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.4:*:*:*:*:*:*:* Versions 4.3.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.5:*:*:*:*:*:*:* Versions 4.3.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.6:*:*:*:*:*:*:* Versions 4.3.6 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.7:*:*:*:*:*:*:* Versions 4.3.7 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.8:*:*:*:*:*:*:* Versions 4.3.8 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.9:*:*:*:*:*:*:* Versions 4.3.9 Vulnerable ·plone
Show 42 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:plone:plone:4.3.10:*:*:*:*:*:*:*4.3.10Vulnerableplone
cpe:2.3:a:plone:plone:4.3.11:*:*:*:*:*:*:*4.3.11Vulnerableplone
cpe:2.3:a:plone:plone:4.3.12:*:*:*:*:*:*:*4.3.12Vulnerableplone
cpe:2.3:a:plone:plone:4.3.14:*:*:*:*:*:*:*4.3.14Vulnerableplone
cpe:2.3:a:plone:plone:4.3.15:*:*:*:*:*:*:*4.3.15Vulnerableplone
cpe:2.3:a:plone:plone:4.3.17:*:*:*:*:*:*:*4.3.17Vulnerableplone
cpe:2.3:a:plone:plone:4.3.18:*:*:*:*:*:*:*4.3.18Vulnerableplone
cpe:2.3:a:plone:plone:4.3.19:*:*:*:*:*:*:*4.3.19Vulnerableplone
cpe:2.3:a:plone:plone:4.3.20:*:*:*:*:*:*:*4.3.20Vulnerableplone
cpe:2.3:a:plone:plone:5.0:-:*:*:*:*:*:*5.0Vulnerableplone
cpe:2.3:a:plone:plone:5.0:rc1:*:*:*:*:*:*5.0 rc1Vulnerableplone
cpe:2.3:a:plone:plone:5.0:rc2:*:*:*:*:*:*5.0 rc2Vulnerableplone
cpe:2.3:a:plone:plone:5.0:rc3:*:*:*:*:*:*5.0 rc3Vulnerableplone
cpe:2.3:a:plone:plone:5.0.1:*:*:*:*:*:*:*5.0.1Vulnerableplone
cpe:2.3:a:plone:plone:5.0.2:*:*:*:*:*:*:*5.0.2Vulnerableplone
cpe:2.3:a:plone:plone:5.0.3:*:*:*:*:*:*:*5.0.3Vulnerableplone
cpe:2.3:a:plone:plone:5.0.4:*:*:*:*:*:*:*5.0.4Vulnerableplone
cpe:2.3:a:plone:plone:5.0.5:*:*:*:*:*:*:*5.0.5Vulnerableplone
cpe:2.3:a:plone:plone:5.0.6:*:*:*:*:*:*:*5.0.6Vulnerableplone
cpe:2.3:a:plone:plone:5.0.7:*:*:*:*:*:*:*5.0.7Vulnerableplone
cpe:2.3:a:plone:plone:5.0.8:*:*:*:*:*:*:*5.0.8Vulnerableplone
cpe:2.3:a:plone:plone:5.0.9:*:*:*:*:*:*:*5.0.9Vulnerableplone
cpe:2.3:a:plone:plone:5.0.10:*:*:*:*:*:*:*5.0.10Vulnerableplone
cpe:2.3:a:plone:plone:5.1:alpha2:*:*:*:*:*:*5.1 alpha2Vulnerableplone
cpe:2.3:a:plone:plone:5.1.1:*:*:*:*:*:*:*5.1.1Vulnerableplone
cpe:2.3:a:plone:plone:5.1.2:*:*:*:*:*:*:*5.1.2Vulnerableplone
cpe:2.3:a:plone:plone:5.1.4:*:*:*:*:*:*:*5.1.4Vulnerableplone
cpe:2.3:a:plone:plone:5.1.5:*:*:*:*:*:*:*5.1.5Vulnerableplone
cpe:2.3:a:plone:plone:5.1.6:*:*:*:*:*:*:*5.1.6Vulnerableplone
cpe:2.3:a:plone:plone:5.1.7:*:*:*:*:*:*:*5.1.7Vulnerableplone
cpe:2.3:a:plone:plone:5.1a1:alpha1:*:*:*:*:*:*5.1a1 alpha1Vulnerableplone
cpe:2.3:a:plone:plone:5.1a2:beta4:*:*:*:*:*:*5.1a2 beta4Vulnerableplone
cpe:2.3:a:plone:plone:5.1b2:beta3:*:*:*:*:*:*5.1b2 beta3Vulnerableplone
cpe:2.3:a:plone:plone:5.1b3:beta2:*:*:*:*:*:*5.1b3 beta2Vulnerableplone
cpe:2.3:a:plone:plone:5.1b4:rc2:*:*:*:*:*:*5.1b4 rc2Vulnerableplone
cpe:2.3:a:plone:plone:5.1rc1:rc1:*:*:*:*:*:*5.1rc1 rc1Vulnerableplone
cpe:2.3:a:plone:plone:5.1rc2:-:*:*:*:*:*:*5.1rc2Vulnerableplone
cpe:2.3:a:plone:plone:5.2.0:*:*:*:*:*:*:*5.2.0Vulnerableplone
cpe:2.3:a:plone:plone:5.2.1:*:*:*:*:*:*:*5.2.1Vulnerableplone
cpe:2.3:a:plone:plone:5.2.2:*:*:*:*:*:*:*5.2.2Vulnerableplone
cpe:2.3:a:plone:plone:5.2.3:*:*:*:*:*:*:*5.2.3Vulnerableplone
cpe:2.3:a:plone:plone:5.2.4:*:*:*:*:*:*:*5.2.4Vulnerableplone
  • cpe:2.3:a:plone:plone:4.3.10:*:*:*:*:*:*:* Versions 4.3.10 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.11:*:*:*:*:*:*:* Versions 4.3.11 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.12:*:*:*:*:*:*:* Versions 4.3.12 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.14:*:*:*:*:*:*:* Versions 4.3.14 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.15:*:*:*:*:*:*:* Versions 4.3.15 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.17:*:*:*:*:*:*:* Versions 4.3.17 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.18:*:*:*:*:*:*:* Versions 4.3.18 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.19:*:*:*:*:*:*:* Versions 4.3.19 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:4.3.20:*:*:*:*:*:*:* Versions 4.3.20 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0:-:*:*:*:*:*:* Versions 5.0 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0:rc1:*:*:*:*:*:* Versions 5.0 rc1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0:rc2:*:*:*:*:*:* Versions 5.0 rc2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0:rc3:*:*:*:*:*:* Versions 5.0 rc3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0.1:*:*:*:*:*:*:* Versions 5.0.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0.3:*:*:*:*:*:*:* Versions 5.0.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0.4:*:*:*:*:*:*:* Versions 5.0.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0.5:*:*:*:*:*:*:* Versions 5.0.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0.6:*:*:*:*:*:*:* Versions 5.0.6 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0.7:*:*:*:*:*:*:* Versions 5.0.7 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0.8:*:*:*:*:*:*:* Versions 5.0.8 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0.9:*:*:*:*:*:*:* Versions 5.0.9 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.0.10:*:*:*:*:*:*:* Versions 5.0.10 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1:alpha2:*:*:*:*:*:* Versions 5.1 alpha2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1.1:*:*:*:*:*:*:* Versions 5.1.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1.2:*:*:*:*:*:*:* Versions 5.1.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1.4:*:*:*:*:*:*:* Versions 5.1.4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1.5:*:*:*:*:*:*:* Versions 5.1.5 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1.6:*:*:*:*:*:*:* Versions 5.1.6 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1.7:*:*:*:*:*:*:* Versions 5.1.7 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1a1:alpha1:*:*:*:*:*:* Versions 5.1a1 alpha1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1a2:beta4:*:*:*:*:*:* Versions 5.1a2 beta4 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1b2:beta3:*:*:*:*:*:* Versions 5.1b2 beta3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1b3:beta2:*:*:*:*:*:* Versions 5.1b3 beta2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1b4:rc2:*:*:*:*:*:* Versions 5.1b4 rc2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1rc1:rc1:*:*:*:*:*:* Versions 5.1rc1 rc1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.1rc2:-:*:*:*:*:*:* Versions 5.1rc2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.2.0:*:*:*:*:*:*:* Versions 5.2.0 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.2.1:*:*:*:*:*:*:* Versions 5.2.1 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.2.2:*:*:*:*:*:*:* Versions 5.2.2 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.2.3:*:*:*:*:*:*:* Versions 5.2.3 Vulnerable ·plone
  • cpe:2.3:a:plone:plone:5.2.4:*:*:*:*:*:*:* Versions 5.2.4 Vulnerable ·plone

Remediation

  • Fix · GHSA-47p5-p3jw-w78w Plone (PyPI) Fixed in 5.2.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33926
  2. 2026-10-03 Alias added: GHSA-47p5-p3jw-w78w

References

Exploit 1

Advisory 2

Other 3

  • TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
  • TI-2024-15757 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13… CVSS 3.1HIGH 7.5
  • TI-2021-12911 Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted… CVSS 3.1CRITICAL 9.9
  • TI-2020-17872 The official plone Docker images before version of 4.3.18-alpine (Alpine specific)… CVSS 3.1CRITICAL 9.8
  • TI-2020-06422 A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows… CVSS 3.1CRITICAL 9.8
  • TI-2015-06065 Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface… CVSS 3.0HIGH 8.8
See all 102 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences