CVE-2017-1000484: Plone - URL Redirection Vulnerability
Summary
CVE-2017-1000484: Plone Open Redirect. Affects plone across 2 version ranges.
>= 2.5, < 4.3.16
>= 5.0.0, < 5.1.0
Fixed in 4.3.16 or 5.1.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for creating and managing websites. Plone is widely used for its robustness, security, and extensibility. However, versions 2.5 to 5.1rc1 of Plone are susceptible to a URL redirection vulnerability.
Vulnerability Detail
The URL redirection vulnerability in Plone allows an attacker to redirect users to their own website by manipulating a specific URL parameter. While this alone may not be highly impactful, it can be combined with other attacks to trick users into logging in and subsequently redirecting them to the attacker's website. The specific URL can be found in the hotfix code, but we refrain from disclosing it here to prevent aiding potential attackers.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.5, < 4.3.164.3.16pip install --upgrade "plone==4.3.16" -
>= 5.0.0, < 5.1.05.1.0pip install --upgrade "plone==5.1.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
The URL redirection vulnerability in Plone versions 2.5 to 5.1rc1 can be exploited to redirect users to malicious websites. It is recommended to upgrade to a fixed version of Plone to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
The vulnerability allows an attacker to redirect users to their own website, potentially leading to phishing attacks or unauthorized access to user accounts.
Yes, this vulnerability can be exploited remotely by tricking users into visiting a maliciously crafted URL.
No, only versions 2.5 to 5.1rc1 of Plone are affected. Upgrading to a fixed version will mitigate the vulnerability.
No specific workaround has been provided. It is recommended to upgrade to a fixed version of Plone.
There is no evidence of active exploitation of this vulnerability at the moment. However, it is crucial to apply the necessary fixes to prevent potential attacks.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
