JVN#50804280: Plone vulnerable to open redirect

Plone provided by Plone Foundation contains an open redirect vulnerability (CWE-601).

Impact

When accessing a specially crafted URL, the user may be redirected to an arbitrary website. As a result, the user may become a victim of a phishing attack.

Solution

Apply the Patch
Apply the patch according to the information provided by the developer.
The developer has released the patch “Products.isurlinportal 1.2.0” for Plone 4.3 and 5 that addresses the vulnerability

According to the developer, Plone 5.2.5 that contains a fix for this vulnerability will be released.

Products Affected

• Plone versions prior to 5.2.5, with versions prior to 1.2.0 of the package “Products.isurlinportal”