{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "dateAssigned": "2017-12-29T00:00:00", "descriptions": [{"lang": "en", "value": "By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)"}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-03T20:00:00Z", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "DATE_ASSIGNED": "2017-12-29", "ID": "CVE-2017-1000484", "REQUESTER": "security@plone.org", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)"}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url", "refsource": "CONFIRM", "url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T22:00:41.653Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2017-1000484", "datePublished": "2018-01-03T20:00:00Z", "dateReserved": "2018-01-03T00:00:00Z", "dateUpdated": "2024-09-16T19:52:21.255Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:*", "matchCriteriaId": "8B635DAD-AC53-4484-8750-200B662DAFD1", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*", "matchCriteriaId": "FDC93803-6506-4382-A013-18010EE7E06B", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "E65977FD-A880-4D16-B56B-94A72774F42D", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "4EA5B4F8-2155-403D-97D8-1272285D508B", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "A3CA2943-77E5-4384-A019-415BBCE62F94", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "B7FF63F6-F1DC-4A97-A2E6-11CF613A31E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "538A3519-5B04-4FE5-A3C0-FD26EFA32705", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:3.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "858CBC5A-C241-475C-8125-C5EA351B12A7", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "F3306D84-0F5B-46BA-9BCC-DCD0A1CDD604", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "E08F4534-A588-463F-A745-39E559AB1CB8", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "B64341BA-5722-415E-9771-9837168AB7C0", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "E2929227-AE19-428D-9AC3-D312A559039B", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "3B6DC866-0FEE-475B-855C-A69E004810CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "50BF3E8E-152C-4E89-BAA2-A952D10F4611", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "F1F88BF6-9058-4CB8-A2D6-5653860CF489", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "B2AA3FA2-15C3-444A-8810-5EF3E0E84D58", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "72F3B15A-CD0F-4CC5-A76F-E62637B30E2E", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.0.10:*:*:*:*:*:*:*", "matchCriteriaId": "D913FCA7-4DAE-4E9A-9146-9AFA8472B04B", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*", "matchCriteriaId": "7C44B53B-953B-4522-A5B4-11573850D2CD", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "D8883023-113A-420A-97B6-A4A9B29CF7DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "4DF4D113-8D9D-4DA3-A177-64783352F608", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "28F9B699-D1A4-425C-84ED-6A8FD29BE7F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.4:*:*:*:*:*:*:*", "matchCriteriaId": "47321B60-67DA-4543-B173-D629A9569B45", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "58B36EB2-723F-4E25-8018-EEB2BE806D9D", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "7962EF74-6AC1-424C-A202-163AFDADA971", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*", "matchCriteriaId": "1F1818BB-E23A-4136-898D-1D0C80C08728", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "5CB06627-133A-40D1-8816-E31E0A9BAD22", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "AE7E448A-2C0C-4DE0-89EA-904718CB6C6D", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "6E727C5C-9E54-49F7-B92C-2492069AAE08", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "BFD68465-4CDC-4788-8932-41335B5C4AC8", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "A7B739E0-FB73-401C-AB1A-E3C1434AA2A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "DCC8B987-5173-4C61-8DE6-B70C18EE6FD3", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "38BA31E8-77EC-478B-BC6E-E2F145A8B9BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*", "matchCriteriaId": "CE168A35-1A46-4A6F-8A08-25CDD886066D", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "CFE0FC06-369B-46CF-9B1E-BAF7AF87E950", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.2:*:*:*:*:*:*:*", "matchCriteriaId": "56571585-E9A2-4B78-B2B1-5D8EADED522A", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.3:*:*:*:*:*:*:*", "matchCriteriaId": "2CDF8A15-401C-453E-8D09-8D4CDD4766DB", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.4:*:*:*:*:*:*:*", "matchCriteriaId": "39B0B1CE-C0D9-495C-B4E7-E52A50BD6D97", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.5:*:*:*:*:*:*:*", "matchCriteriaId": "043B3CBE-DEA2-474D-AA57-1830A470B621", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.6:*:*:*:*:*:*:*", "matchCriteriaId": "08A6842B-B479-4D91-928A-1CCE1DCB936E", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.7:*:*:*:*:*:*:*", "matchCriteriaId": "875A368A-F1D6-4795-99CF-A96DBCD1D407", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.8:*:*:*:*:*:*:*", "matchCriteriaId": "B5962C24-BC35-4E27-B81B-E2D21F83FB13", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.9:*:*:*:*:*:*:*", "matchCriteriaId": "55BCE259-700F-4E39-8565-99E4DFDA6F9E", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.10:*:*:*:*:*:*:*", "matchCriteriaId": "CD0755E5-2001-499F-90EA-6C2133D116D0", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.11:*:*:*:*:*:*:*", "matchCriteriaId": "5893527F-D365-4A39-9104-1B478804F0BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.12:*:*:*:*:*:*:*", "matchCriteriaId": "6CBF50C9-1710-48F6-ADD7-E23C10385726", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.14:*:*:*:*:*:*:*", "matchCriteriaId": "6D8DAC05-E1F0-4791-9B98-2AC0A370E885", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:4.3.15:*:*:*:*:*:*:*", "matchCriteriaId": "191E3004-2D6C-4F15-99C5-6E9B78606712", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0:*:*:*:*:*:*:*", "matchCriteriaId": "E8C6DFBF-5CC6-49A7-BC83-E8F686815F6A", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "8AF9FB6C-134F-4653-8771-1BF46AB39344", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "E22BA768-96DE-408F-8979-4CC58B50A09C", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "1672268D-2EFB-4D9E-99D4-AAEFEA659091", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "9EF74DD4-27BB-4881-B324-B53336EF0648", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.2:*:*:*:*:*:*:*", "matchCriteriaId": "1C6962EC-8398-4564-9840-AECB3E3D697D", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.3:*:*:*:*:*:*:*", "matchCriteriaId": "ADE89FE6-DBF6-4CDD-BBA3-B34AEEAE6BA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.4:*:*:*:*:*:*:*", "matchCriteriaId": "83D341D6-AB11-444F-88FD-22303D1E3F65", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.5:*:*:*:*:*:*:*", "matchCriteriaId": "DAF8A5BB-2F6A-474F-9DCE-0AF9E8E1D1D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.6:*:*:*:*:*:*:*", "matchCriteriaId": "58165598-70DB-48AD-BD6E-793B103DC15F", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.7:*:*:*:*:*:*:*", "matchCriteriaId": "41CCC319-0F03-4DD4-8D99-32402A1E2B98", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.8:*:*:*:*:*:*:*", "matchCriteriaId": "B31894A8-1122-4212-8521-2E741321B6A4", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.0.9:*:*:*:*:*:*:*", "matchCriteriaId": "862A10FA-5E6F-4AEB-89E9-279DEDE9F596", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.1:a1:*:*:*:*:*:*", "matchCriteriaId": "39E8A13F-B8F8-490D-AB5D-E8FF5EA0490B", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.1:a2:*:*:*:*:*:*", "matchCriteriaId": "DD34F775-A365-4B65-8F60-F09EDD57B2EF", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.1:b2:*:*:*:*:*:*", "matchCriteriaId": "EDBCFF87-68FE-4A1B-90AE-DB0ABC814A1E", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.1:b3:*:*:*:*:*:*", "matchCriteriaId": "811AB79A-14F9-46A1-BF30-8BFA65E555F8", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.1:b4:*:*:*:*:*:*", "matchCriteriaId": "F592B13B-6AC0-4E0F-9860-E7A9EC994EF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:plone:plone:5.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "3ADCF80F-A850-4050-8540-99D9B514D6ED", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)"}, {"lang": "es", "value": "Al enlazar a una URL espec\u00edfica en Plone 2.5-5.1rc1 con un par\u00e1metro, un atacante podr\u00eda enviarte a su propia p\u00e1gina web. Por s\u00ed mismo, no es tan malo: al atacante le resultar\u00eda m\u00e1s sencillo enlazar directamente a su propio sitio web. Pero, en combinaci\u00f3n con otro ataque, podr\u00edas ser enviado al formulario de inicio de sesi\u00f3n de Plone, iniciar la sesi\u00f3n, ser redirigido a la URL espec\u00edfica y volver a ser redireccionado al sitio web del atacante. (La URL espec\u00edfica puede verse inspeccionando el c\u00f3digo del hotfix, pero no queremos pon\u00e9rselo f\u00e1cil a los atacantes poni\u00e9ndolo por aqu\u00ed)."}], "id": "CVE-2017-1000484", "lastModified": "2024-11-21T03:04:50.290", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-03T20:29:00.580", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "plone: Open URL redirect", "id": "1532487", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1532487"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.1", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-601", "details": ["By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)"], "name": "CVE-2017-1000484", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "package_name": "conga", "product_name": "Red Hat Enterprise Linux 5"}], "public_date": "2017-11-28T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2017-1000484\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-1000484"], "threat_severity": "Low"}