GHSA-82j9-wfcf-9v2h

Plone Open Redirect Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-7936

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Plone	>= 4.0, < 4.3.20	4.3.20
PyPI	Plone	>= 5.0rc1, < 5.1.7	5.1.7
PyPI	Plone	>= 5.2.0, < 5.2.2	5.2.2

Details

As written in the advisory (Markdown source, shown as plain text).

An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-7936 advisory
https://github.com/plone/Plone package
https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-85.yaml web
https://plone.org/security/hotfix/20200121 web
https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places web
https://www.openwall.com/lists/oss-security/2020/01/22/1 web
http://www.openwall.com/lists/oss-security/2020/01/24/1 web