Plone Open Redirect Vulnerability
Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) `%2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions` or (2) `folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions` or the (3) `came_from` parameter to `/login_form`.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-7137US | medium6.1 | — | ||
Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites a… | ||||
02
references
External citations — patches, advisories, analysis.
- http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.htmlWEB
- http://seclists.org/fulldisclosure/2016/Oct/80WEB
- http://www.openwall.com/lists/oss-security/2016/09/05/4WEB
- http://www.openwall.com/lists/oss-security/2016/09/05/5WEB
- http://www.securityfocus.com/archive/1/539572/100/0/threadedWEB
- http://www.securityfocus.com/bid/92752WEB
- https://github.com/plone/PlonePACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-60.yamlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan