GitHub Advisoryadvisory · PyPI

GHSA-69vh-662j-v988 Plone Open Redirect Vulnerability

MEDIUM Published 2022-05-14 Modified 2024-10-15 Official page ↗
Aliases
CVE-2016-7137
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2023-07-31

Affected packages

• PyPI Plone: >= 5.0, <= 5.0.6 (no fix yet) • PyPI Plone: >= 4.0, <= 4.3.11 (no fix yet) • PyPI Plone: >= 3.3, <= 3.3.6 (no fix yet)

Description

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) `%2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions` or (2) `folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions` or the (3) `came_from` parameter to `/login_form`.

Related

Alias · CVE (1)

  • CVE-2016-7137 Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References