TI-2022-07652 Aliases CVE-2022-23599 GHSA-g4c2-ghfg-g5rh

Cross-site Scripting and Open Redirect in Products.ATContentTypes

LOW 29CWE-79Published 2022-01-28 · Updated 2025-05-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting, Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79 and CWE-601.

Summary

Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user's cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0075 55th percentileScored 2026-11-07

Fix Partial Products.ATContentTypes (PyPI): 3.0.6Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	Products.ATContentTypes (PyPI)	before 3.0.6	3.0.6	Patch available	GHSA-g4c2-ghfg-g5rh

— Vendor— Affected all versions Fixed in — No fix listed CNA
Products.ATContentTypes (PyPI) Vendor— Affected before 3.0.6 Fixed in 3.0.6 Patch available GHSA-g4c2-ghfg-g5rh

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:plone:plone::::::::	before 3.0.6	Vulnerable	plone

cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:* Versions before 3.0.6 Vulnerable ·plone

Remediation

Fix · GHSA-g4c2-ghfg-g5rh Products.ATContentTypes (PyPI) Fixed in 3.0.6 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 5	Affected	No fix planned: Out of support scope

Timeline

2026-10-02 Threatist record created from CVE-2022-23599
2026-10-03 Alias added: GHSA-g4c2-ghfg-g5rh

References

Patch 1

https://github.com/plone/Products.ATContentTypes/commit/fc793f88f35a15a68b52e4abed77af0da5fdbab8

Advisory 2

Other 2

TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
TI-2021-13226 An issue in Plone CMS v. CVSS 3.1HIGH 8.8
TI-2024-15757 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13… CVSS 3.1HIGH 7.5
TI-2021-12911 Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted… CVSS 3.1CRITICAL 9.9
TI-2020-17872 The official plone Docker images before version of 4.3.18-alpine (Alpine specific)… CVSS 3.1CRITICAL 9.8
TI-2020-06422 A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows… CVSS 3.1CRITICAL 9.8

See all 102 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences