CVE-2024-0669: 
Python vulnerability analysis and mitigation

A Cross-Frame Scripting (XFS) vulnerability (CVE-2024-0669) was discovered in Plone CMS affecting versions below 6.0.5. The vulnerability was disclosed on January 18, 2024, and was assigned by the Spanish National Cybersecurity Institute (INCIBE). The affected software is Plone CMS, a content management system, with versions 6.x up to (excluding) 6.0.7 (NIST NVD, INCIBE Advisory).

The vulnerability is classified as CWE-1021 (Improper Restriction of Rendered UI Layers or Frames). It received a CVSS v3.1 base score of 6.3 (MEDIUM) from INCIBE with vector string AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, while NIST assigned a higher CVSS score of 7.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (NIST NVD).

An attacker could store a malicious URL to be opened by an administrator and execute a malicious iframe element, potentially leading to unauthorized access and compromise of the system (INCIBE Advisory).

The vulnerability has been fixed in Plone CMS version 6.0.7. Organizations running affected versions should upgrade to version 6.0.7 or later to address this security issue (INCIBE Advisory).