GHSA-xvwv-6wvx-px9x

    Dashboard / Vulnerabilities / GHSA-xvwv-6wvx-px9x

    GHSA-xvwv-6wvx-px9x

    Published: 4 Jan 2019Last Modified: 18 Oct 2024

    Summary: Plone Open Redirect

    Details: By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website.

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-1000484, https://github.com/plone/Products.CMFPlone/issues/2232, https://github.com/advisories/GHSA-xvwv-6wvx-px9x, https://github.com/plone/Plone, https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-73.yaml, https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url

    Affected packages

    Package

    Name: plone

    Purl: pkg:pypi/plone

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 2.5
    Fixed -4.3.16

    Affected versions

    3.2
    3.2.1
    3.2.2
    3.2.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-xvwv-6wvx-px9x | CVE-DB