CVE-2016-7137: Open Redirect Vulnerabilities in Plone CMS
Summary
CVE-2016-7137: Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in... Affects plone across 3 version ranges.
>= 3.3, < 4.0a1
>= 4.0, < 4.3.12
>= 5.0, < 5.0.7
Fixed in 4.0a1, 4.3.12 or 5.0.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone CMS is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Plone CMS is widely used by organizations and individuals to build and maintain their websites.
Vulnerability Detail
Multiple open redirect vulnerabilities have been discovered in Plone CMS versions 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6. These vulnerabilities allow remote attackers to redirect users to arbitrary websites and conduct phishing attacks. The vulnerabilities can be exploited by providing a malicious URL in the referer parameter to specific endpoints or by manipulating the came_from parameter in the login form. By exploiting these vulnerabilities, an attacker can trick users into visiting malicious websites and potentially steal sensitive information or perform other malicious actions.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.3, < 4.0a14.0a1pip install --upgrade "plone==4.0a1" -
>= 4.0, < 4.3.124.3.12pip install --upgrade "plone==4.3.12" -
>= 5.0, < 5.0.75.0.7pip install --upgrade "plone==5.0.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for these vulnerabilities. It is strongly recommended to apply the official patches or upgrade to the fixed versions as soon as possible.
Conclusion
Open redirect vulnerabilities have been discovered in Plone CMS, which can be exploited by attackers to redirect users to arbitrary websites and conduct phishing attacks. To mitigate these vulnerabilities, it is crucial to upgrade to the fixed versions of Plone CMS or apply the official patches. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
An open redirect vulnerability is a security flaw that allows an attacker to redirect users to arbitrary websites. This can be exploited to trick users into visiting malicious websites or phishing pages.
These vulnerabilities can be exploited by providing a malicious URL in the referer parameter to specific endpoints or by manipulating the came_from parameter in the login form.
By exploiting these vulnerabilities, an attacker can redirect users to malicious websites and potentially steal sensitive information, perform phishing attacks, or conduct other malicious activities.
Yes, versions 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 of Plone CMS are affected by these vulnerabilities.
No, there is no known workaround for these vulnerabilities. It is recommended to apply the official patches or upgrade to the fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
