CVE-2022-23599: Cross-site Scripting and Open Redirect in Products.ATContentTypes

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-01-28 · updated 2026-06-17
Weakness: CWE-79

Description

Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user's cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.

Affected products

Plone CMS: before 3.0.6 — fixed in 3.0.6

How to fix

Upgrade to a fixed version: Plone CMS 3.0.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-23599 or the next vulnerability affects your stack