CVE-2017-1000481 Products.CMFPlone Open Redirect Vulnerability
Attackers can bypass redirect restrictions to send users to malicious sites or execute JavaScript after login.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-1000481?
CVE-2017-1000481 is a medium-severity vulnerability in Plone Plone, published on 3 Jan 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix.
Weakness: CWE-601
Which versions are affected by CVE-2017-1000481?
12 open source packages ship an affected version, including products-cmfplone, Plone and Products.CMFPlone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
products-cmfplone PyPI | All versions | 4.3.17, 5.0.10, 5.1.0 |
products-cmfplone PyPI | All versions | 4.3.17 |
products-cmfplone PyPI | From 5.0.0 | 5.0.10 |
products-cmfplone PyPI | From 5.1a1 | 5.1.0 |
Plone PyPI | From 2.5 | 4.3.16 |
Plone PyPI | From 5 | 5.1.0 |
6 more packages
Products.CMFPlone PyPI | All versions | 4.3.17 |
Products.CMFPlone PyPI | From 5.0.0 | 5.0.10 |
Products.CMFPlone PyPI | From 5.1a1 | 5.1.0 |
plone PyPI | From 2.5 | 4.3.16, 5.1.0 |
plone PyPI | From 2.5 | 4.3.16 |
plone PyPI | From 5 | 5.1.0 |
Products include Plone Plone.
How do I fix CVE-2017-1000481?
Upgrade products-cmfplone to a fixed version for your release line: 4.3.17, 5.0.10 or 5.1.0.
Is CVE-2017-1000481 being exploited?
There is no known exploitation of CVE-2017-1000481 in the wild and no public exploit code.
Other vulnerabilities in Plone Plone
Sources
Also known as GHSA-8g72-gq68-6gqh, PYSEC-2018-70, PYSEC-2026-2963.