PT-2020-19858 · Plone · Plone

Damiano Esposito · Published 2020-01-23 · Updated 2022-05-24 · CVE-2020-7936

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Plone versions 4.0 through 5.2.1

Description The issue is related to an open redirect on the login form and possibly other areas, allowing an attacker to create a link that redirects to an attacker's site after login.

Recommendations For versions 4.0 through 5.2.1, consider restricting access to the login form until a fix is available. As a temporary workaround, avoid using the login form with external links to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-7936

GHSA-82J9-WFCF-9V2H

PYSEC-2020-85

Affected Products

Plone

References · 10

• https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7936 · Vendor Advisory
• https://plone.org/security/hotfix/20200121 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-85 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-82j9-wfcf-9v2h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7936 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-85.yaml · Note
• https://github.com/plone/Plone · Note
• http://openwall.com/lists/oss-security/2020/01/24/1 · Note
• https://openwall.com/lists/oss-security/2020/01/22/1 · Note