CVE-2017-1000484 (GCVE-0-2017-1000484)

Vulnerability from cvelistv5 – Published: 2018-01-03 20:00 – Updated: 2024-09-16 19:52
VLAI?
Summary
By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:00:41.653Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2017-12-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don\u0027t want to make it too easy for attackers by spelling it out here.)"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-03T20:00:00Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2017-12-29",
          "ID": "CVE-2017-1000484",
          "REQUESTER": "security@plone.org",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don\u0027t want to make it too easy for attackers by spelling it out here.)"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url",
              "refsource": "CONFIRM",
              "url": "https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-1000484",
    "datePublished": "2018-01-03T20:00:00Z",
    "dateReserved": "2018-01-03T00:00:00Z",
    "dateUpdated": "2024-09-16T19:52:21.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B635DAD-AC53-4484-8750-200B662DAFD1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FDC93803-6506-4382-A013-18010EE7E06B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E65977FD-A880-4D16-B56B-94A72774F42D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4EA5B4F8-2155-403D-97D8-1272285D508B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A3CA2943-77E5-4384-A019-415BBCE62F94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B7FF63F6-F1DC-4A97-A2E6-11CF613A31E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"538A3519-5B04-4FE5-A3C0-FD26EFA32705\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:3.3.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"858CBC5A-C241-475C-8125-C5EA351B12A7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F3306D84-0F5B-46BA-9BCC-DCD0A1CDD604\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E08F4534-A588-463F-A745-39E559AB1CB8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B64341BA-5722-415E-9771-9837168AB7C0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E2929227-AE19-428D-9AC3-D312A559039B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3B6DC866-0FEE-475B-855C-A69E004810CD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"50BF3E8E-152C-4E89-BAA2-A952D10F4611\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F1F88BF6-9058-4CB8-A2D6-5653860CF489\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B2AA3FA2-15C3-444A-8810-5EF3E0E84D58\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"72F3B15A-CD0F-4CC5-A76F-E62637B30E2E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.0.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D913FCA7-4DAE-4E9A-9146-9AFA8472B04B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7C44B53B-953B-4522-A5B4-11573850D2CD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D8883023-113A-420A-97B6-A4A9B29CF7DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DF4D113-8D9D-4DA3-A177-64783352F608\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"28F9B699-D1A4-425C-84ED-6A8FD29BE7F8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"47321B60-67DA-4543-B173-D629A9569B45\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"58B36EB2-723F-4E25-8018-EEB2BE806D9D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.1.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7962EF74-6AC1-424C-A202-163AFDADA971\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1F1818BB-E23A-4136-898D-1D0C80C08728\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5CB06627-133A-40D1-8816-E31E0A9BAD22\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AE7E448A-2C0C-4DE0-89EA-904718CB6C6D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6E727C5C-9E54-49F7-B92C-2492069AAE08\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BFD68465-4CDC-4788-8932-41335B5C4AC8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A7B739E0-FB73-401C-AB1A-E3C1434AA2A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.2.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DCC8B987-5173-4C61-8DE6-B70C18EE6FD3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.2.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"38BA31E8-77EC-478B-BC6E-E2F145A8B9BD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CE168A35-1A46-4A6F-8A08-25CDD886066D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CFE0FC06-369B-46CF-9B1E-BAF7AF87E950\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"56571585-E9A2-4B78-B2B1-5D8EADED522A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2CDF8A15-401C-453E-8D09-8D4CDD4766DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"39B0B1CE-C0D9-495C-B4E7-E52A50BD6D97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"043B3CBE-DEA2-474D-AA57-1830A470B621\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"08A6842B-B479-4D91-928A-1CCE1DCB936E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"875A368A-F1D6-4795-99CF-A96DBCD1D407\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B5962C24-BC35-4E27-B81B-E2D21F83FB13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"55BCE259-700F-4E39-8565-99E4DFDA6F9E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CD0755E5-2001-499F-90EA-6C2133D116D0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5893527F-D365-4A39-9104-1B478804F0BD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6CBF50C9-1710-48F6-ADD7-E23C10385726\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6D8DAC05-E1F0-4791-9B98-2AC0A370E885\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:4.3.15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"191E3004-2D6C-4F15-99C5-6E9B78606712\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E8C6DFBF-5CC6-49A7-BC83-E8F686815F6A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8AF9FB6C-134F-4653-8771-1BF46AB39344\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"E22BA768-96DE-408F-8979-4CC58B50A09C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"1672268D-2EFB-4D9E-99D4-AAEFEA659091\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9EF74DD4-27BB-4881-B324-B53336EF0648\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1C6962EC-8398-4564-9840-AECB3E3D697D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ADE89FE6-DBF6-4CDD-BBA3-B34AEEAE6BA5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"83D341D6-AB11-444F-88FD-22303D1E3F65\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DAF8A5BB-2F6A-474F-9DCE-0AF9E8E1D1D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"58165598-70DB-48AD-BD6E-793B103DC15F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"41CCC319-0F03-4DD4-8D99-32402A1E2B98\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B31894A8-1122-4212-8521-2E741321B6A4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"862A10FA-5E6F-4AEB-89E9-279DEDE9F596\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.1:a1:*:*:*:*:*:*\", \"matchCriteriaId\": \"39E8A13F-B8F8-490D-AB5D-E8FF5EA0490B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.1:a2:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD34F775-A365-4B65-8F60-F09EDD57B2EF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.1:b2:*:*:*:*:*:*\", \"matchCriteriaId\": \"EDBCFF87-68FE-4A1B-90AE-DB0ABC814A1E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.1:b3:*:*:*:*:*:*\", \"matchCriteriaId\": \"811AB79A-14F9-46A1-BF30-8BFA65E555F8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.1:b4:*:*:*:*:*:*\", \"matchCriteriaId\": \"F592B13B-6AC0-4E0F-9860-E7A9EC994EF6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:plone:plone:5.1:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"3ADCF80F-A850-4050-8540-99D9B514D6ED\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don\u0027t want to make it too easy for attackers by spelling it out here.)\"}, {\"lang\": \"es\", \"value\": \"Al enlazar a una URL espec\\u00edfica en Plone 2.5-5.1rc1 con un par\\u00e1metro, un atacante podr\\u00eda enviarte a su propia p\\u00e1gina web. Por s\\u00ed mismo, no es tan malo: al atacante le resultar\\u00eda m\\u00e1s sencillo enlazar directamente a su propio sitio web. Pero, en combinaci\\u00f3n con otro ataque, podr\\u00edas ser enviado al formulario de inicio de sesi\\u00f3n de Plone, iniciar la sesi\\u00f3n, ser redirigido a la URL espec\\u00edfica y volver a ser redireccionado al sitio web del atacante. (La URL espec\\u00edfica puede verse inspeccionando el c\\u00f3digo del hotfix, pero no queremos pon\\u00e9rselo f\\u00e1cil a los atacantes poni\\u00e9ndolo por aqu\\u00ed).\"}]",
      "id": "CVE-2017-1000484",
      "lastModified": "2024-11-21T03:04:50.290",
      "metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:N\", \"baseScore\": 5.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 4.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
      "published": "2018-01-03T20:29:00.580",
      "references": "[{\"url\": \"https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-601\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2017-1000484\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2018-01-03T20:29:00.580\",\"lastModified\":\"2024-11-21T03:04:50.290\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don\u0027t want to make it too easy for attackers by spelling it out here.)\"},{\"lang\":\"es\",\"value\":\"Al enlazar a una URL espec\u00edfica en Plone 2.5-5.1rc1 con un par\u00e1metro, un atacante podr\u00eda enviarte a su propia p\u00e1gina web. Por s\u00ed mismo, no es tan malo: al atacante le resultar\u00eda m\u00e1s sencillo enlazar directamente a su propio sitio web. Pero, en combinaci\u00f3n con otro ataque, podr\u00edas ser enviado al formulario de inicio de sesi\u00f3n de Plone, iniciar la sesi\u00f3n, ser redirigido a la URL espec\u00edfica y volver a ser redireccionado al sitio web del atacante. (La URL espec\u00edfica puede verse inspeccionando el c\u00f3digo del hotfix, pero no queremos pon\u00e9rselo f\u00e1cil a los atacantes poni\u00e9ndolo por aqu\u00ed).\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:N\",\"baseScore\":5.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-601\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B635DAD-AC53-4484-8750-200B662DAFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FDC93803-6506-4382-A013-18010EE7E06B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E65977FD-A880-4D16-B56B-94A72774F42D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4EA5B4F8-2155-403D-97D8-1272285D508B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A3CA2943-77E5-4384-A019-415BBCE62F94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B7FF63F6-F1DC-4A97-A2E6-11CF613A31E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"538A3519-5B04-4FE5-A3C0-FD26EFA32705\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:3.3.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"858CBC5A-C241-475C-8125-C5EA351B12A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F3306D84-0F5B-46BA-9BCC-DCD0A1CDD604\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E08F4534-A588-463F-A745-39E559AB1CB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B64341BA-5722-415E-9771-9837168AB7C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2929227-AE19-428D-9AC3-D312A559039B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B6DC866-0FEE-475B-855C-A69E004810CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50BF3E8E-152C-4E89-BAA2-A952D10F4611\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1F88BF6-9058-4CB8-A2D6-5653860CF489\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B2AA3FA2-15C3-444A-8810-5EF3E0E84D58\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"72F3B15A-CD0F-4CC5-A76F-E62637B30E2E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D913FCA7-4DAE-4E9A-9146-9AFA8472B04B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C44B53B-953B-4522-A5B4-11573850D2CD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D8883023-113A-420A-97B6-A4A9B29CF7DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DF4D113-8D9D-4DA3-A177-64783352F608\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"28F9B699-D1A4-425C-84ED-6A8FD29BE7F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"47321B60-67DA-4543-B173-D629A9569B45\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"58B36EB2-723F-4E25-8018-EEB2BE806D9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7962EF74-6AC1-424C-A202-163AFDADA971\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F1818BB-E23A-4136-898D-1D0C80C08728\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CB06627-133A-40D1-8816-E31E0A9BAD22\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE7E448A-2C0C-4DE0-89EA-904718CB6C6D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E727C5C-9E54-49F7-B92C-2492069AAE08\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BFD68465-4CDC-4788-8932-41335B5C4AC8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7B739E0-FB73-401C-AB1A-E3C1434AA2A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCC8B987-5173-4C61-8DE6-B70C18EE6FD3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.2.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"38BA31E8-77EC-478B-BC6E-E2F145A8B9BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE168A35-1A46-4A6F-8A08-25CDD886066D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CFE0FC06-369B-46CF-9B1E-BAF7AF87E950\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"56571585-E9A2-4B78-B2B1-5D8EADED522A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CDF8A15-401C-453E-8D09-8D4CDD4766DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"39B0B1CE-C0D9-495C-B4E7-E52A50BD6D97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"043B3CBE-DEA2-474D-AA57-1830A470B621\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"08A6842B-B479-4D91-928A-1CCE1DCB936E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"875A368A-F1D6-4795-99CF-A96DBCD1D407\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B5962C24-BC35-4E27-B81B-E2D21F83FB13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"55BCE259-700F-4E39-8565-99E4DFDA6F9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CD0755E5-2001-499F-90EA-6C2133D116D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5893527F-D365-4A39-9104-1B478804F0BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6CBF50C9-1710-48F6-ADD7-E23C10385726\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D8DAC05-E1F0-4791-9B98-2AC0A370E885\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:4.3.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"191E3004-2D6C-4F15-99C5-6E9B78606712\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8C6DFBF-5CC6-49A7-BC83-E8F686815F6A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9FB6C-134F-4653-8771-1BF46AB39344\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E22BA768-96DE-408F-8979-4CC58B50A09C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"1672268D-2EFB-4D9E-99D4-AAEFEA659091\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EF74DD4-27BB-4881-B324-B53336EF0648\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C6962EC-8398-4564-9840-AECB3E3D697D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ADE89FE6-DBF6-4CDD-BBA3-B34AEEAE6BA5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83D341D6-AB11-444F-88FD-22303D1E3F65\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DAF8A5BB-2F6A-474F-9DCE-0AF9E8E1D1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"58165598-70DB-48AD-BD6E-793B103DC15F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"41CCC319-0F03-4DD4-8D99-32402A1E2B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B31894A8-1122-4212-8521-2E741321B6A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"862A10FA-5E6F-4AEB-89E9-279DEDE9F596\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.1:a1:*:*:*:*:*:*\",\"matchCriteriaId\":\"39E8A13F-B8F8-490D-AB5D-E8FF5EA0490B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.1:a2:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD34F775-A365-4B65-8F60-F09EDD57B2EF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.1:b2:*:*:*:*:*:*\",\"matchCriteriaId\":\"EDBCFF87-68FE-4A1B-90AE-DB0ABC814A1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.1:b3:*:*:*:*:*:*\",\"matchCriteriaId\":\"811AB79A-14F9-46A1-BF30-8BFA65E555F8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.1:b4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F592B13B-6AC0-4E0F-9860-E7A9EC994EF6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:plone:plone:5.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3ADCF80F-A850-4050-8540-99D9B514D6ED\"}]}]}],\"references\":[{\"url\":\"https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.