CVE-2024-0669 is a medium severity cross-frame scripting flaw in Plone CMS, scored CVSS 6.3. The NVD description says Plone versions below 6.0.5 are affected. INCIBE says the manufacturer fixed the issue in version 6.0.7. Use the steps below to confirm your exposure and plan the fix.
What's affected
The NVD description says Plone versions below 6.0.5 are affected. The INCIBE notice lists 6.0.5 itself as the affected resource.
The CVSS vector in the record is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, with a base score of 6.3 (Medium). KEV status: not listed in the record.
Fixed version: INCIBE says the manufacturer fixed the issue in version 6.0.7.
Where sources differ: The NVD text says versions below 6.0.5 are affected, while the INCIBE notice lists 6.0.5 as the affected resource and says the fix is in 6.0.7. Treat anything below 6.0.7 as needing review.
How to check if you're exposed
Find the installed version in the product admin area, its version file, or your deployment manifest, and compare it with the record. Review web server access logs for unexpected requests to the affected path, and check whether the admin or affected component is reachable from the internet.
What to do now
- Find every deployment of the affected product and its version.
- Apply the vendor fix if one exists. If the vendor has not responded, consider removing the product or placing it behind a web application firewall and an IP allow list.
- Block or monitor requests to the affected path, and review logs for earlier abuse.
- Restrict the admin area to a trusted network.
Why it matters
CWE-1021 describes this class. Improper restriction of rendered UI layers, often called clickjacking or cross frame scripting, means a page can be embedded in a frame or made to render attacker influenced frames. Frame restrictions through response headers such as Content Security Policy frame ancestors are the usual control.
The record notes that an exploit has been disclosed publicly, which shortens the time between disclosure and scanning by others. The record does not say the flaw is exploited in the wild, and it is not in the CISA KEV catalog.
For a wider view, a free in-browser dependency scan and the Gold directory show where Plone CMS sits in your software, and reachability analysis helps separate code that can actually be hit from code that merely ships.
Quick check
Is CVE-2024-0669 exploited in the wild?
The record's KEV flag is false, and none of the pages I fetched said otherwise. That is not proof of safety, so still patch or restrict access.
What if no fix exists?
Restrict the affected path and the admin area to trusted networks, and consider replacing the product.
Sources
- INCIBE CERT notice on Plone CMS
- Safeguard Gold entry for CVE-2024-0669
- NVD record data for CVE-2024-0669.
Last reviewed: 19 October 2026.
