Lucene search

MitreCVE-2016-7137

HistoryMar 07, 2017 - 4:59 p.m.

CVE-2016-7137

2017-03-0716:59:00

CWE-601

mitre

web.nvd.nist.gov

cve

2016

7137

open redirect

plone cms

vulnerability

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.003

Percentile

71.5%

JSON

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) %2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions or (2) folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions or the (3) came_from parameter to /login_form.

Affected configurations

Nvd

Node

ploneploneMatch3.3

ploneploneMatch3.3.1

ploneploneMatch3.3.2

ploneploneMatch3.3.3

ploneploneMatch3.3.4

ploneploneMatch3.3.5

ploneploneMatch3.3.6

ploneploneMatch4.0

ploneploneMatch4.0.1

ploneploneMatch4.0.2

ploneploneMatch4.0.3

ploneploneMatch4.0.4

ploneploneMatch4.0.5

ploneploneMatch4.0.7

ploneploneMatch4.0.8

ploneploneMatch4.0.9

ploneploneMatch4.0.10

ploneploneMatch4.1

ploneploneMatch4.1.1

ploneploneMatch4.1.2

ploneploneMatch4.1.3

ploneploneMatch4.1.4

ploneploneMatch4.1.5

ploneploneMatch4.1.6

ploneploneMatch4.2

ploneploneMatch4.2.1

ploneploneMatch4.2.2

ploneploneMatch4.2.3

ploneploneMatch4.2.4

ploneploneMatch4.2.5

ploneploneMatch4.2.6

ploneploneMatch4.2.7

ploneploneMatch4.3

ploneploneMatch4.3.1

ploneploneMatch4.3.2

ploneploneMatch4.3.3

ploneploneMatch4.3.4

ploneploneMatch4.3.5

ploneploneMatch4.3.6

ploneploneMatch4.3.7

ploneploneMatch4.3.8

ploneploneMatch4.3.9

ploneploneMatch4.3.10

ploneploneMatch4.3.11

ploneploneMatch5.0

ploneploneMatch5.0a1

ploneploneMatch5.0rc1

ploneploneMatch5.0rc2

ploneploneMatch5.0rc3

ploneploneMatch5.0.1

ploneploneMatch5.0.2

ploneploneMatch5.0.3

ploneploneMatch5.0.4

ploneploneMatch5.0.5

ploneploneMatch5.0.6

ploneploneMatch5.1a1

VendorProductVersionCPE
ploneplone3.3cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*
ploneplone3.3.1cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*
ploneplone3.3.2cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*
ploneplone3.3.3cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*
ploneplone3.3.4cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*
ploneplone3.3.5cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*
ploneplone3.3.6cpe:2.3:a:plone:plone:3.3.6:*:*:*:*:*:*:*
ploneplone4.0cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*
ploneplone4.0.1cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*
ploneplone4.0.2cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
plone	plone	3.3	cpe:2.3:a:plone:plone:3.3:::::::*
plone	plone	3.3.1	cpe:2.3:a:plone:plone:3.3.1:::::::*
plone	plone	3.3.2	cpe:2.3:a:plone:plone:3.3.2:::::::*
plone	plone	3.3.3	cpe:2.3:a:plone:plone:3.3.3:::::::*
plone	plone	3.3.4	cpe:2.3:a:plone:plone:3.3.4:::::::*
plone	plone	3.3.5	cpe:2.3:a:plone:plone:3.3.5:::::::*
plone	plone	3.3.6	cpe:2.3:a:plone:plone:3.3.6:::::::*
plone	plone	4.0	cpe:2.3:a:plone:plone:4.0:::::::*
plone	plone	4.0.1	cpe:2.3:a:plone:plone:4.0.1:::::::*
plone	plone	4.0.2	cpe:2.3:a:plone:plone:4.0.2:::::::*

Rows per page:

1-10 of 561

References

packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.html

seclists.org/fulldisclosure/2016/Oct/80

www.openwall.com/lists/oss-security/2016/09/05/4

www.openwall.com/lists/oss-security/2016/09/05/5

www.securityfocus.com/archive/1/539572/100/0/threaded

www.securityfocus.com/bid/92752

plone.org/security/hotfix/20160830/open-redirection-in-plone

Social References

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.3

Confidence

High

EPSS

0.003

Percentile

71.5%

JSON

Related for CVE-2016-7137