PyPI/plone CVE-2016-7137: unknown, EPSS 1.67%
Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing
Action: Upgrade plone to 4.0a1 or later.
pip install plone==5.0.7pip install plone==4.3.12pip install plone==4.0a1Affected
| introduced | fixed | last affected |
|---|---|---|
| 3.3 | 4.0a1 | - |
| 4.0 | 4.3.12 | - |
| 5.0 | 5.0.7 | - |
Fixed versions
| 5.0.7 | 4.3.12 | 4.0a1 |
Sources
- osv: PYSEC-2017-60
- https://plone.org/security/hotfix/20160830/open-redirection-in-plone
- http://www.openwall.com/lists/oss-security/2016/09/05/5
- http://www.openwall.com/lists/oss-security/2016/09/05/4
- http://seclists.org/fulldisclosure/2016/Oct/80
- http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html
- http://www.securityfocus.com/bid/92752
- http://www.securityfocus.com/archive/1/539572/100/0/threaded
- https://github.com/advisories/GHSA-69vh-662j-v988
CVE-2016-7137 · published · modified · JSON