CVE-2017-1000481: Plone Open Redirect Vulnerability
Summary
CVE-2017-1000481: Products.CMFPlone Open Redirect Vulnerability. Affects products-cmfplone across 3 version ranges.
< 4.3.17
>= 5.0.0, < 5.0.10
>= 5.1a1, < 5.1.0
Fixed in 4.3.17, 5.0.10 or 5.1.0, depending on the release line you run. How to fix ↓
Also tracked for
- plone · PyPI
The same CVE-2017-1000481 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, editing, and publishing. Plone versions 2.5 to 5.1rc1 are affected by an open redirect vulnerability.
Vulnerability Detail
The vulnerability in Plone arises from the way it handles login redirects. When a user visits a page that requires authentication, Plone redirects them to the login form with a 'came_from' parameter set to the previous URL. After successful login, the user is redirected back to the original page. An attacker can exploit this behavior by crafting a malicious link that tricks the user into thinking they are still on the legitimate Plone site. This can lead to various attacks, such as phishing or executing malicious JavaScript code. While Plone already includes checks to prevent most of these attacks, additional methods of bypassing the protection were discovered and fixed with a hotfix.
How To Fix
Latest published version: 6.2.2 as of 22 Oct 2026
pip install --upgrade "products-cmfplone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.3.174.3.17pip install --upgrade "products-cmfplone==4.3.17" -
>= 5.0.0, < 5.0.105.0.10pip install --upgrade "products-cmfplone==5.0.10" -
>= 5.1a1, < 5.1.05.1.0pip install --upgrade "products-cmfplone==5.1.0"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The Plone open redirect vulnerability (CVE-2017-1000481) allows attackers to trick users into visiting malicious sites or executing malicious code. Plone has released a hotfix to address the vulnerability, and users are advised to update their installations or apply the hotfix to mitigate the risk. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for products-cmfplone →
FAQ
You can check the version of Plone you are using. If it is between 2.5 and 5.1rc1, your installation is vulnerable.
An attacker can trick users into visiting a malicious site by crafting a specially crafted link. This can lead to phishing attacks or the execution of malicious JavaScript code.
Yes, Plone has released a hotfix that addresses the bypass methods and ensures redirects only occur within the same Plone site.
No, there are no known workarounds for this vulnerability. It is recommended to apply the hotfix or update to a patched version of Plone.
To keep your Plone installation secure, it is recommended to regularly update to the latest version and apply security patches as they become available.
References
Related vulnerabilities
Recent vulnerabilities recorded for products-cmfplone.
