PT-2018-5249 · Plone · Plone

Publicado 2018-01-03 · Atualizado 2019-01-04 · CVE-2017-1000484

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1

Description The issue allows an attacker to redirect users to their own website by linking to a specific URL in Plone with a parameter. Although this is not severe on its own, it can be combined with another attack to send users to the Plone login form, then to the specific URL, and finally to the attacker's website. The specific URL can be identified by inspecting the hotfix code.

Recommendations For Plone versions 2.5 through 5.1rc1, consider restricting access to the specific URL that can be used for redirection until a patch is available. As a temporary workaround, avoid using the parameter that allows the redirect to the attacker's website.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2017-1000484

GHSA-XVWV-6WVX-PX9X

PYSEC-2018-73

Produtos afetados

Plone

Referências · 10

• https://github.com/plone/Products.CMFPlone/issues/2232 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-73.yaml · Nota
• https://github.com/plone/Plone · Nota
• https://osv.dev/vulnerability/GHSA-xvwv-6wvx-px9x · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000484 · Aviso do Fabricante
• https://github.com/advisories/GHSA-xvwv-6wvx-px9x · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000484 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000484 · Nota
• https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2018-73 · Aviso do Fabricante