CVE-2013-4200: Plone - URLTool Class allows phishing attacks
Summary
CVE-2013-4200: The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to b... Affects plone across 3 version ranges.
>= 2.1, < 4.1.1
>= 4.2, < 4.2.6
>= 4.3, < 4.3.2
Fixed in 4.1.1, 4.2.6 or 4.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. The URLTool class in Plone is responsible for handling URLs and performing related operations.
Vulnerability Detail
The isURLInPortal method in the URLTool class in in_portal.py in Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 has a vulnerability that allows remote attackers to bypass the allow_external_login_sites filtering property. This vulnerability occurs when the method treats URLs starting with a space as relative URLs. As a result, an attacker can redirect users to arbitrary websites and conduct phishing attacks by inserting a space before a URL in the 'next' parameter to acl_users/credentials_cookie_auth/require_login.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.1, < 4.1.14.1.1pip install --upgrade "plone==4.1.1" -
>= 4.2, < 4.2.64.2.6pip install --upgrade "plone==4.2.6" -
>= 4.3, < 4.3.24.3.2pip install --upgrade "plone==4.3.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The URLTool class in Plone versions 2.1 through 4.3.1 has a vulnerability that allows remote attackers to bypass filtering and conduct phishing attacks. Users should upgrade to the fixed versions (4.1.1, 4.2.6, or 4.3.2) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
This vulnerability allows remote attackers to bypass filtering and redirect users to malicious websites, potentially leading to phishing attacks.
You can use the Vulert Playground at Vulert Scanner to check if your Plone installation is affected by this vulnerability. Simply enter your Pipfile.lock and the playground will provide information on any vulnerabilities found.
There are no known public exploits available for this vulnerability at the moment.
There is no evidence of active attacks exploiting this vulnerability currently.
While upgrading to a fixed version is the recommended solution, it is also advisable to implement other security best practices such as regular security updates, strong authentication mechanisms, and user awareness training to minimize the risk of phishing attacks.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
