Sign in
Deutsch English Español Polski
Medium

Products.CMFPlone Open Redirect Vulnerability

  • Disclosed: 03.01.2018
  • Updated: 11.10.2026 14:18

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the isURLInPortal check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Python (PyPI) plone >= 2.5, < 4.3.16, >= 5, < 5.1.0 4.3.16, 5.1.0
Python (PyPI) products-cmfplone < 4.3.17, >= 5.0.0, < 5.0.10, >= 5.1a1, < 5.1.0 4.3.17, 5.0.10, 5.1.0

References

CVSS score 6.1/10
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-601
Platform
Python (PyPI)
Package
plone, products-cmfplone
Disclosed
03.01.2018
Updated
11.10.2026 14:18

Sources and licenses

OSV / GitHub Advisory Database - PYSEC-2018-70 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-8g72-gq68-6gqh - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-2963 - PyPA Advisory Database; CC BY 4.0

Vulnerability history: plone

All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (101) in the archive
Total entries
101
First → latest
09.2006 03.2024
Without a fix
10
Exploited in attacks
0

Severity breakdown

  • Critical 5
  • High 36
  • Medium 58
  • Low 2

Disclosures per year

earlier: 52

Severity:
  1. Cross-Frame Scripting vulnerability has been found on Plone CMS
    High · 7.1 CVE-2024-0669 < 6.0.7 6.0.7
  2. Server-Side Request Forgery in Plone CMS
    High · 8.8 CVE-2021-33926 >= 4.3, < 5.2.5 5.2.5
  3. Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
    High CVE-2011-4030 >= 4.0, < 4.0.10, >= 4.1, < 4.1.1, >= 4.2a1, < 4.2a3 4.0.10, 4.1.1, 4.2a3
  4. Plone Improper Session Management
    High CVE-2008-1393 < 3.0 3.0
  5. Plone CMS Improper Session Management
    High CVE-2008-1394 < 3.0 3.0
  6. Server-Side Request Forgery in Plone
    High · 7.5 CVE-2021-33511 <= 5.2.4 no fix
  7. Incorrect Permission Assignment for Critical Resource in Plone
    Critical · 9.9 CVE-2021-33509 < 5.2.5 5.2.5
  8. Improper Restriction of XML External Entity Reference in Plone
    High · 8.8 CVE-2020-28736 < 5.2.3 5.2.3
  9. SSRF attacks via tracebacks in Plone
    High · 8.8 CVE-2020-28735 < 5.2.3 5.2.3
  10. Improper Restriction of XML External Entity Reference in Plone
    High · 8.8 CVE-2020-28734 < 5.2.3 5.2.3
  11. Plone Privilege Escallation
    High · 8.8 CVE-2020-7938 >= 5.2.0, < 5.2.2 5.2.2
  12. Plone Unauthenticated Write Vulnerability
    Critical · 9.8 CVE-2020-7941 >= 4.3, <= 5.2.1 no fix
  13. SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.)
    High · 8.8 CVE-2020-7939 >= 4.0, < 5.2.2 5.2.2
  14. Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.
    High · 7.5 CVE-2020-7940 >= 4.3, < 5.2.1 5.2.1
  15. Products.CMFPlone Open Redirect Vulnerability this entry
    Medium · 6.1 CVE-2017-1000481 >= 2.5, < 4.3.16, >= 5, < 5.1.0 4.3.16, 5.1.0
  16. Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part
    High · 6.5 CVE-2017-1000483 >= 2.5, < 4.3.16, >= 5, < 5.1.0 4.3.16, 5.1.0
  17. Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.
    High · 8.8 CVE-2015-7293 < 5.0a1 5.0a1
  18. Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.
    High · 7.5 CVE-2015-7318 >= 3.3, < 4.0a1 4.0a1
  19. Plone and Zope2 do not reseed pseudo-random number generator
    High · 7.5 CVE-2012-6661 >= 3.2.2, < 4.2.3, >= 4.3a1, < 4.3b1 4.2.3, 4.3b1
  20. at_download.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs (Files and Images) stored on custom content types via a crafted URL.
    High · 7.5 CVE-2012-5501 < 4.2.3, >= 4.3a0, < 4.3b1 4.2.3, 4.3b1
  21. python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (memory consumption) via a large value, related to formatColumns.
    High · 7.5 CVE-2012-5499 < 4.2.3, >= 4.3a0, < 4.3b1 4.2.3, 4.3b1
  22. queryCatalog.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to bypass caching and cause a denial of service via a crafted request to a collection.
    High · 7.5 CVE-2012-5498 < 4.2.3, >= 4.3a0, < 4.3b1 4.2.3, 4.3b1
  23. registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.
    High · 7.2 CVE-2012-5485 < 4.2.3, >= 4.3a0, < 4.3b1 4.2.3, 4.3b1
  24. kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.
    High · 7.5 CVE-2012-5496 < 3.3.6 3.3.6
  25. python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to "go_back."
    Critical · 9.8 CVE-2012-5495 < 4.2.3, >= 4.3a0, < 4.3b1 4.2.3, 4.3b1
  26. atat.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read private data structures via a request for a view without a name.
    High · 7.5 CVE-2012-5505 < 4.2.3, >= 4.3a0, < 4.3b1 4.2.3, 4.3b1
  27. python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to cause a denial of service (infinite loop) via an RSS feed request for a folder the user does not have permissio
    High · 7.5 CVE-2012-5506 < 4.2.3, >= 4.3a0, < 4.3b1 4.2.3, 4.3b1
  28. python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.
    High · 9.8 CVE-2012-5488 < 4.2.3, >= 4.3a0, < 4.3b1 4.2.3, 4.3b1
  29. Plone and Zope2 affected by Race Condition
    High · 7.5 CVE-2012-5507 >= 3.2.2, < 4.2.3, >= 4.3a1, < 4.3b1 4.2.3, 4.3b1
  30. Plone allows remote attackers to read hidden folder contents
    High · 7.5 CVE-2012-5503 < 4.2.3, >= 4.3a1, < 4.3b1 4.2.3, 4.3b1
  31. Plone and Zope2 vulnerable to unauthorized access to restricted attributes
    High · 6.5 CVE-2012-5489 >= 3.2.2, < 4.2.3, >= 4.3a1, < 4.3b1 4.2.3, 4.3b1
  32. HTTP header injection in Plone and Zope2
    High · 7.5 CVE-2012-5486 >= 3.3.2, < 4.2.3, >= 4.3a1, < 4.3b1 4.2.3, 4.3b1
  33. typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers t
    High · 5.9 CVE-2013-4193 >= 2.1, < 4.1.1, >= 4.2, < 4.2.6, >= 4.3, < 4.3.2 4.1.1, 4.2.6, 4.3.2
  34. member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.
    High · 8.1 CVE-2013-4197 >= 2.1, < 4.1.1, >= 4.2, < 4.2.6, >= 4.3, < 4.3.2 4.1.1, 4.2.6, 4.3.2
  35. sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors.
    High · 6.5 CVE-2013-4192 >= 2.1, < 4.1.1, >= 4.2, < 4.2.6, >= 4.3, < 4.3.2 4.1.1, 4.2.6, 4.3.2
  36. The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows r
    High · 7.5 CVE-2013-4200 >= 2.1, < 4.1.1, >= 4.2, < 4.2.6, >= 4.3, < 4.3.2 4.1.1, 4.2.6, 4.3.2
  37. Plone Denial of Service vulnerability
    High · 7.5 CVE-2011-4462 < 4.1.4 4.1.4
  38. High severity vulnerability that affects Plone and Zope2
    High CVE-2011-2528 >= 3.3.2, < 3.3.6 3.3.6
  39. Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and
    Critical · 9.1 CVE-2011-0720 < 4.0.1 4.0.1
  40. Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arb
    High · 7.5 CVE-2008-0164 < 3.1 3.1
  41. Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity modul
    Critical · 9.8 CVE-2007-5741 >= 2.5, < 2.5.5, >= 3.0, < 3.0.3 2.5.5, 3.0.3
  42. Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security dec
    High · 9.1 CVE-2006-4247 >= 2.5, < 2.5.1 2.5.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.