GHSA-x7wf-5mjc-6x76
SSRF attacks via tracebacks in Plone
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | Plone | < 5.2.3 | 5.2.3 |
| PyPI | plone.app.event | < 3.2.10 | 3.2.10 |
| PyPI | plone.app.theming | < 4.1.6 | 4.1.6 |
| PyPI | plone.app.dexterity | < 2.6.8 | 2.6.8 |
| PyPI | plone.supermodel | < 1.6.3 | 1.6.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2020-28735
- https://github.com/plone/Products.CMFPlone/issues/3209
- https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
- https://github.com/advisories/GHSA-x7wf-5mjc-6x76
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-247.yaml
- https://www.misakikata.com/codes/plone/python-en.html