Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) %2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions or (2) folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions or the (3) came_from parameter to /login_form.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html - Exploit, Third Party Advisory, VDB Entry | |
| References | () http://seclists.org/fulldisclosure/2016/Oct/80 - Third Party Advisory, VDB Entry | |
| References | () http://www.openwall.com/lists/oss-security/2016/09/05/4 - Mailing List, Patch, Third Party Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2016/09/05/5 - Mailing List, Patch, Third Party Advisory | |
| References | () http://www.securityfocus.com/archive/1/539572/100/0/threaded - | |
| References | () http://www.securityfocus.com/bid/92752 - | |
| References | () https://plone.org/security/hotfix/20160830/open-redirection-in-plone - Vendor Advisory |
Information
Published : 2017-03-07 16:59
Updated : 2025-04-20 01:37
NVD link : CVE-2016-7137
Mitre link : CVE-2016-7137
CVE.ORG link : CVE-2016-7137
JSON object : View
Products Affected
plone
- plone
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')