PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-7147 Plone CVE debrief

CVE-2016-7147 is a cross-site scripting flaw in Plone's Zope ZMI search path, specifically the manage_findResult component. The record says remote attackers could inject arbitrary web script or HTML through vectors involving double quotes, with obj_ids:tokens called out as a demonstration input. NVD also ties the issue to an incomplete fix for CVE-2016-7140. The affected versions listed in the source corpus are Plone before 4.3.12 and 5.x before 5.0.7. It is not marked as a CISA KEV item in the supplied enrichment.

Vendor
Plone
Product
CVE-2016-7147
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-04
Original CVE updated
2026-05-13
Advisory published
2017-02-04
Advisory updated
2026-05-13

Who should care

Plone administrators, security teams, and developers maintaining affected Plone instances should care, especially where Zope ZMI search or related admin pages are used.

Technical summary

The vulnerability is a CWE-79 XSS issue in the manage_findResult component of Plone's search feature in Zope ZMI. The supplied NVD vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, which indicates network reachability and user interaction are required, with low confidentiality and integrity impact and no availability impact. The source description attributes the flaw to an incomplete fix for CVE-2016-7140 and lists vulnerable Plone versions up to 4.3.11 and 5.0.6.

Defensive priority

Medium. The issue is remotely reachable and can affect admin-facing workflows, but it requires user interaction and is scored 6.1 rather than high severity.

Recommended defensive actions

  • Upgrade affected Plone installations to 4.3.12, 5.0.7, or a later fixed release.
  • Review and apply the Plone hotfix/advisory referenced in the 20170117 security update.
  • Audit any custom templates, search-result views, or ZMI integrations that render untrusted data in the search flow.
  • Verify that the affected search path no longer reflects user-controlled input into HTML or JavaScript contexts after patching.

Evidence notes

This debrief is based on the supplied NVD record, which provides the vulnerability description, CVSS vector, CWE-79 classification, affected version entries, and reference list. The vendor advisory links on plone.org are the primary remediation references, and the description explicitly states the vulnerability exists because of an incomplete fix for CVE-2016-7140. No exploit code, weaponized reproduction, or unsupported impact claims are included.

Official resources

The CVE record was published on 2017-02-04, which is the appropriate disclosure date for this item in the supplied data. The vendor hotfix reference points to Plone's 20170117 security update. The later 2026-05-13 modified timestamp in theN