Ukuze uthole uhlelo lokuphatha okuqukethwe mahhala , ebhalwe ngePython kusetshenziswa iseva yesicelo se-Zope, ama-patches ngokuqedwa (Izihlonzi ze-CVE azikakanikwa.) Izinkinga zithinta konke ukukhishwa kwamanje kwe-Plone, okuhlanganisa naleyo ekhishwe ezinsukwini ezimbalwa ezedlule. . Izinkinga zihlelelwe ukuthi zilungiswe ekukhishweni okuzayo kwe-Plone 4.3.20, 5.1.7 kanye no-5.2.2, kuze kube yilapho kunconywa ukuthi kusetshenziswe. .
Ubungozi obuhlonziwe (imininingwane ayikadalulwa):
- Ukwenyuka kwelungelo ngokukhohlisa kwe-Rest API (kwenzeka kuphela uma i-plone.restapi inikwe amandla);
- Ukufakwa esikhundleni kwe-SQL ngenxa yokungaphunyuki ngokwanele kokwakhiwa kwe-SQL ku-DTML kanye nezinto zokuxhuma ze-DBMS (inkinga eqondiswe ngqo futhi ivela kwezinye izinhlelo zokusebenza ezisuselwe kuyo);
- Amathuba okubhala kabusha okuqukethwe ngokukhohlisa indlela ye-PUT ngaphandle kokuba namalungelo okubhala;
- Vula ukuqondisa kabusha kufomu lokungena;
- Amathuba okudlulisa izixhumanisi zangaphandle ezinonya ngokudlula ukuhlolwa kwe-isURLInPortal;
- Ukuhlolwa kwamandla ephasiwedi kuyehluleka kwezinye izimo;
- I-Cross-site scripting (XSS) ngokushintshanisa ikhodi endaweni kanhlokweni.
Source: opennet.ru
