CVE-2016-7137: Plone Open Redirect Vulnerability
Summary
CVE-2016-7137: Plone Open Redirect Vulnerability. Affects plone across 3 version ranges.
>= 3.3, <= 3.3.6
>= 4.0, <= 4.3.11
>= 5.0, <= 5.0.6
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone CMS is an open-source content management system written in Python. It provides a robust and flexible platform for building websites, intranets, and web applications. Plone is widely used due to its security features and extensibility. However, versions 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 of Plone are vulnerable to an open redirect vulnerability.
Vulnerability Detail
The open redirect vulnerability in Plone allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks. The vulnerability can be exploited by manipulating the referer parameter in URLs or the came_from parameter in the login_form. Specifically, the following URLs are affected:
%2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actionsfolder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions/login_form
By exploiting this vulnerability, an attacker can trick users into visiting malicious websites, potentially leading to phishing attacks and the disclosure of sensitive information.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a non-vulnerable version of Plone.
Conclusion
The Plone open redirect vulnerability allows attackers to redirect users to malicious websites and conduct phishing attacks. It is crucial to upgrade to a non-vulnerable version of Plone to mitigate this risk. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for plone →
FAQ
An open redirect vulnerability allows an attacker to redirect users to arbitrary websites by manipulating the URL parameters. This can be exploited for phishing attacks and other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your Plone installation is affected by this vulnerability. Simply enter your Pipfile.lock and the playground will analyze it for vulnerabilities.
There are no known public exploits for this vulnerability at the moment. However, it is important to patch your Plone installation to prevent potential attacks.
Yes, this vulnerability can be exploited remotely by sending crafted URLs to unsuspecting users.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate severity.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
