6.1

CVE-2017-1000484

By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Plone ≫ Plone Version 2.5.5
Plone ≫ Plone Version 3.3
Plone ≫ Plone Version 3.3.1
Plone ≫ Plone Version 3.3.2
Plone ≫ Plone Version 3.3.3
Plone ≫ Plone Version 3.3.4
Plone ≫ Plone Version 3.3.5
Plone ≫ Plone Version 3.3.6
Plone ≫ Plone Version 4.0
Plone ≫ Plone Version 4.0.1
Plone ≫ Plone Version 4.0.2
Plone ≫ Plone Version 4.0.3
Plone ≫ Plone Version 4.0.4
Plone ≫ Plone Version 4.0.5
Plone ≫ Plone Version 4.0.7
Plone ≫ Plone Version 4.0.8
Plone ≫ Plone Version 4.0.9
Plone ≫ Plone Version 4.0.10
Plone ≫ Plone Version 4.1
Plone ≫ Plone Version 4.1.1
Plone ≫ Plone Version 4.1.2
Plone ≫ Plone Version 4.1.3
Plone ≫ Plone Version 4.1.4
Plone ≫ Plone Version 4.1.5
Plone ≫ Plone Version 4.1.6
Plone ≫ Plone Version 4.2
Plone ≫ Plone Version 4.2.1
Plone ≫ Plone Version 4.2.2
Plone ≫ Plone Version 4.2.3
Plone ≫ Plone Version 4.2.4
Plone ≫ Plone Version 4.2.5
Plone ≫ Plone Version 4.2.6
Plone ≫ Plone Version 4.2.7
Plone ≫ Plone Version 4.3
Plone ≫ Plone Version 4.3.1
Plone ≫ Plone Version 4.3.2
Plone ≫ Plone Version 4.3.3
Plone ≫ Plone Version 4.3.4
Plone ≫ Plone Version 4.3.5
Plone ≫ Plone Version 4.3.6
Plone ≫ Plone Version 4.3.7
Plone ≫ Plone Version 4.3.8
Plone ≫ Plone Version 4.3.9
Plone ≫ Plone Version 4.3.10
Plone ≫ Plone Version 4.3.11
Plone ≫ Plone Version 4.3.12
Plone ≫ Plone Version 4.3.14
Plone ≫ Plone Version 4.3.15
Plone ≫ Plone Version 5.0
Plone ≫ Plone Version 5.0 Update rc1
Plone ≫ Plone Version 5.0 Update rc2
Plone ≫ Plone Version 5.0 Update rc3
Plone ≫ Plone Version 5.0.1
Plone ≫ Plone Version 5.0.2
Plone ≫ Plone Version 5.0.3
Plone ≫ Plone Version 5.0.4
Plone ≫ Plone Version 5.0.5
Plone ≫ Plone Version 5.0.6
Plone ≫ Plone Version 5.0.7
Plone ≫ Plone Version 5.0.8
Plone ≫ Plone Version 5.0.9
Plone ≫ Plone Version 5.1 Update a1
Plone ≫ Plone Version 5.1 Update a2
Plone ≫ Plone Version 5.1 Update b2
Plone ≫ Plone Version 5.1 Update b3
Plone ≫ Plone Version 5.1 Update b4
Plone ≫ Plone Version 5.1 Update rc1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.91% 0.562
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url
Vendor Advisory