pypi package report

Is products-atcontenttypes safe?

1 known vulnerability, worst severity MODERATE.

// reach

0 direct dependencies

none carry a known advisory

    0 packages depend on it

    an advisory here reaches each of them

      Create a free accountfor every dependency path, dependent and what to upgrade
      // ai model usage

      No published models are known to use this package.

      cvss
      0.0
      medium

      severity out of 10

      epss
      0.00%
      medium

      chance of exploitation in 30 days, 54th percentile of all CVEs

      xyz score
      not scored

      CyberXYZ composite out of 10

      fig. 01 — GHSA-g4c2-ghfg-g5rh, the advisory selected below

      // 1 advisories

      GHSA-g4c2-ghfg-g5rh

      MODERATECVE-2022-23599
      // impact

      Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on your cache settings.

      // patches

      A new version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2 (Python 2 only) and will be included in Plone 5.2.7.

      Note that the Products.CMFPlone package has the same problem in the 4.3 series. plone.app.contenttypes has the same problem in all versions, see advisory. For all unpatched versions of the three packages, you can use the following workaround.

      // workaround

      Make sure the imageviewfullscreen page is not stored in the cache. In Plone:

      • Login as Manager and go to Site Setup.
      • Go to the 'Caching' control panel. If this does not exist, or 'Enable caching' is not checked, you should normally not be vulnerable.
      • Click on the tab 'Caching operations'.
      • Under 'Legacy template mappings' locate the ruleset 'Content item view'.
      • From the last column ('Templates') remove 'imageviewfullscreen'.
      • Click on Save.
      // reporter

      This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Secure Consulting. Thank you!

      // for more information

      If you have any questions or comments about this advisory, email us at [security@plone.org](mailto:security@plone.org) This is also the correct address to use when you want to report a possible vulnerability. See our security report policy.

      // cvss v3.1 vector

      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

      Attack vector
      Network
      Attack complexity
      Low
      Privileges required
      None
      User interaction
      Required
      Scope
      Unchanged
      Confidentiality
      Low
      Integrity
      None
      Availability
      None

      Checked 2026-10-23 at 18:53 UTC. The most recent advisory here was published 2022-01-28. Updated continuously from NVD, GHSA, OSV and CNA feeds.

      Think a verdict here is wrong? Tell us — we respond within 2 business days.