CVE-2020-28735 SSRF attacks via tracebacks in Plone
Attackers with Manager role can exploit the tracebacks feature to perform Server-Side Request Forgery attacks in Plone.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-28735?
CVE-2020-28735 is a high-severity server-side request forgery vulnerability in Plone Plone, published on 30 Dec 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).
Weakness: CWE-918
Which versions are affected by CVE-2020-28735?
15 open source packages ship an affected version, including plone, Plone and plone-app-dexterity. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
plone PyPI | All versions | 5.2.3 |
plone PyPI | All versions | 5.2.3 |
Plone PyPI | All versions | 5.2.3 |
plone-app-dexterity PyPI | All versions | 2.6.8 |
plone-app-dexterity PyPI | All versions | 2.6.8 |
plone-app-event PyPI | All versions | 3.2.10 |
9 more packages
plone-app-event PyPI | All versions | 3.2.10 |
plone-app-theming PyPI | All versions | 4.1.6 |
plone-app-theming PyPI | All versions | 4.1.6 |
plone-supermodel PyPI | All versions | 1.6.3 |
plone-supermodel PyPI | All versions | 1.6.3 |
plone.app.dexterity PyPI | All versions | 2.6.8 |
plone.app.event PyPI | All versions | 3.2.10 |
plone.app.theming PyPI | All versions | 4.1.6 |
plone.supermodel PyPI | All versions | 1.6.3 |
Products include Plone Plone.
How do I fix CVE-2020-28735?
Upgrade plone to 5.2.3 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-28735 being exploited?
There is no known exploitation of CVE-2020-28735 in the wild and no public exploit code.
Other vulnerabilities in Plone Plone
Sources
Also known as GHSA-x7wf-5mjc-6x76, PYSEC-2020-247, PYSEC-2026-2881, PYSEC-2026-2884, PYSEC-2026-2887, PYSEC-2026-737.