GHSA-82j9-wfcf-9v2h
- Source
- https://github.com/advisories/GHSA-82j9-wfcf-9v2h
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-82j9-wfcf-9v2h/GHSA-82j9-wfcf-9v2h.json
- Aliases
- Published
- 2022-05-24T17:07:14Z
- Modified
- 2024-02-16T08:15:18.564844Z
- Details
-
An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2020-7936
- https://github.com/plone/Plone
- https://plone.org/security/hotfix/20200121
- https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places
- https://www.openwall.com/lists/oss-security/2020/01/22/1
- http://www.openwall.com/lists/oss-security/2020/01/24/1
Affected packages
PyPI / plone
Package
- Name
- plone
Affected versions
4.*
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.1a1
4.1a2
4.1a3
4.1b1
4.1b2
4.1rc2
4.1rc3
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.2a1
4.2a2
4.2b1
4.2b2
4.2rc1
4.2rc2
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.2.6
4.2.7
4.3a1
4.3a2
4.3b1
4.3b2
4.3rc1
4.3
4.3.1
4.3.2
4.3.3
4.3.4
4.3.5
4.3.6
4.3.7
4.3.8
4.3.9
4.3.10
4.3.11
4.3.12
4.3.13
4.3.14
4.3.15
4.3.16
4.3.17
4.3.18
4.3.19
PyPI / plone
Package
- Name
- plone
PyPI / plone
Package
- Name
- plone