CVE-2016-7137
Plone Open Redirect Vulnerability
Also known as GHSA-69vh-662j-v988, PYSEC-2017-60
Published 9 y ago · modified 4 mo ago · JSON
Summary
Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) %2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions or (2) folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions or the (3) came_from parameter to /login_form.
Exploit prediction (EPSS)
1.67% probability of exploitation in the next 30 days, higher than 77% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| GitHub | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | plone | >=5.0, <=5.0.6 >=4.0, <=4.3.11 >=3.3, <=3.3.6 >=5.0, <5.0.7 >=4.0, <4.3.12 >=3.3, <4.0a1 | 5.0.7 4.3.12 4.0a1 |
Classification
- Weakness
- CWE-601 URL Redirection to Untrusted Site
References
- packetstormsecurity.com /files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html · x_refsource_MISC, x_transferred
- seclists.org /fulldisclosure/2016/Oct/80 · mailing-list, x_refsource_FULLDISC, x_transferred
- openwall.com /lists/oss-security/2016/09/05/4 · mailing-list, x_refsource_MLIST, x_transferred
- plone.org /security/hotfix/20160830/open-redirection-in-plone · x_refsource_CONFIRM, x_transferred
- openwall.com /lists/oss-security/2016/09/05/5 · mailing-list, x_refsource_MLIST, x_transferred
- securityfocus.com /archive/1/539572/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- securityfocus.com /bid/92752 · vdb-entry, x_refsource_BID, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-7137 · advisory
- github.com /plone/Plone · package
- github.com /pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-60.yaml · web
- web.archive.org /web/20210625091607/http://www.securityfocus.com/bid/92752 · web
- web.archive.org /web/20210625092107/http://www.securityfocus.com/archive/1/539572/100/0/threaded · web
- github.com /advisories/GHSA-69vh-662j-v988 · advisory
Sources
- CVE List: CVE-2016-7137
- GitHub Advisory: GHSA-69vh-662j-v988
- NVD: CVE-2016-7137
- OSV: PYSEC-2017-60
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.