CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2020-7936
Medium (6.1) in plone plone. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in plone 4.3.20, 5.1.7, 5.2.2.
An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 60% of CVEs (scores of 2026-10-31)
- CWE
- CWE-601
- Published
- Modified
- Record from
- the NVD, synced
Affected
- plone:plone
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-82j9-wfcf-9v2h | PyPI | plone | >=4.0 <4.3.20 | 4.3.20 |
| GHSA-82j9-wfcf-9v2h | PyPI | plone | >=5.0rc1 <5.1.7 | 5.1.7 |
| GHSA-82j9-wfcf-9v2h | PyPI | plone | >=5.2.0 <5.2.2 | 5.2.2 |
| PYSEC-2020-85 | PyPI | plone | >=4.0 <5.2.2 | 5.2.2 |
References
- http://www.openwall.com/lists/oss-security/2020/01/24/1
- https://plone.org/security/hotfix/20200121
- https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places
- https://www.openwall.com/lists/oss-security/2020/01/22/1
- http://www.openwall.com/lists/oss-security/2020/01/24/1