PT-2017-9088 · Plone · Plone Cms

Sebastian Perez · Published 2017-03-07 · Updated 2022-05-14 · CVE-2016-7137

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plone CMS versions 3.3.x through 3.3.6 Plone CMS versions 4.x through 4.3.11 Plone CMS versions 5.x through 5.0.6

Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be achieved via a URL in the referer parameter to specific endpoints, such as %2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions or folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions, or the came from parameter to the /login form endpoint.

Recommendations For Plone CMS versions 3.3.x through 3.3.6, update to a version outside of this range to mitigate the risk. For Plone CMS versions 4.x through 4.3.11, update to a version outside of this range to mitigate the risk. For Plone CMS versions 5.x through 5.0.6, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the vulnerable endpoints, such as %2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions and folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions, and avoid using the came from parameter in the /login form endpoint until a patch is available.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2016-7137

GHSA-69VH-662J-V988

PYSEC-2017-60

Affected Products

Plone Cms

References · 16

• 🔥 http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html · Exploit
• http://openwall.com/lists/oss-security/2016/09/05/5 · Patch
• https://plone.org/security/hotfix/20160830/open-redirection-in-plone · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7137 · Security Note
• http://openwall.com/lists/oss-security/2016/09/05/4 · Patch
• https://osv.dev/vulnerability/GHSA-69vh-662j-v988 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2017-60 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7137 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-60.yaml · Note
• https://github.com/plone/Plone · Note
• https://web.archive.org/web/20210625091607/http://securityfocus.com/bid/92752 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7137 · Note
• http://seclists.org/fulldisclosure/2016/Oct/80 · Note
• http://securityfocus.com/archive/1/539572/100/0/threaded · Note
• https://web.archive.org/web/20210625092107/http://securityfocus.com/archive/1/539572/100/0/threaded · Note