PYSEC-2014-64
See a problem?- Import Source
- https://github.com/pypa/advisory-database/blob/main/vulns/plone/PYSEC-2014-64.yaml
- JSON Data
- https://api.osv.dev/v1/vulns/PYSEC-2014-64
- Aliases
-
- CVE-2013-4200
- GHSA-56p3-rrp4-2j82
- Published
- 2014-01-21T16:06:00Z
- Modified
- 2026-06-10T17:01:30Z
- Summary
- [none]
- Details
-
The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the "next" parameter to acl_users/credentials_cookie_auth/require_login.
- References
-
- http://plone.org/products/plone/security/advisories/20130618-announcement
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4200
- http://www.openwall.com/lists/oss-security/2013/08/01/2
- http://plone.org/products/plone-hotfix/releases/20130618
- http://www.securityfocus.com/archive/1/530787/100/0/threaded
- https://github.com/advisories/GHSA-56p3-rrp4-2j82
Affected packages
PyPI / plone
Package
- Name
- plone
- View open source insights on deps.dev
- Purl
- pkg:pypi/plone
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced2.1Fixed4.1.1Introduced4.2Fixed4.2.6Introduced4.3Fixed4.3.2
Affected versions
3.*
3.2a1
3.2rc1
3.2
3.2.1
3.2.2
3.2.3
3.3b1
3.3rc1
3.3rc2
3.3rc3
3.3rc4
3.3rc5
3.3
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6
4.*
4.0a1
4.0a2
4.0a3
4.0a4
4.0a5
4.0b1
4.0b2
4.0b3
4.0b4
4.0b5
4.0rc1
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.1a1
4.1a2
4.1a3
4.1b1
4.1b2
4.1rc2
4.1rc3
4.1
4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5
4.3
4.3.1