QID 980775

QID 980775: Python (pip) Security Update for plone (GHSA-xvwv-6wvx-px9x)

By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)

Successful exploitation of this vulnerability may affect the confidentiality, integrity, and availability of the targeted user.

CVSS V3 rated as High - 6.1 severity.

CVSS V2 rated as Medium - 5.8 severity.

Solution

Customers are advised to refer to GHSA-xvwv-6wvx-px9x for updates pertaining to this vulnerability.

Vendor References

GHSA-xvwv-6wvx-px9x - github.com/advisories/GHSA-xvwv-6wvx-px9x

CVEs related to QID 980775

CVE-2017-1000484 |

Software Advisories

Advisory ID	Software	Component	Link
GHSA-xvwv-6wvx-px9x	plone		github.com/advisories/GHSA-xvwv-6wvx-px9x

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].