CVE-2020-28735

Root

Cause

The vulnerability is a Server-Side Request Forgery (SSRF) flaw in Plone, a content management system built on Zope/CMF. The issue exists in the tracebacks feature, which allows users with the Manager role to view detailed error traces. The feature fails to sanitize or validate URLs or network requests, enabling an attacker to make arbitrary HTTP requests from the server. This is documented in the official advisory and NVD entry [1][2].

Exploitation

Exploitation requires an authenticated user with the Manager role, as the tracebacks feature is restricted to that role [1]. The attack vector is network-based (AV:N) and has low attack complexity (AC:L), meaning no unusual conditions are needed [1]. The attacker can craft a request that triggers a traceback, then use the feature to make the server send requests to internal or external systems.

Impact

Successful exploitation allows the attacker to perform SSRF, which can lead to information disclosure by accessing internal services (e.g., cloud metadata endpoints), scanning internal networks, or interacting with other systems not intended to be exposed [3][4]. The CVSS score is 9.1 (Critical) due to high impact on confidentiality, integrity, and availability [1][2].

Mitigation

Plone 5.2.3 and later versions contain a fix for this vulnerability [2]. Users should upgrade to Plone 5.2.3 or newer immediately. No workaround is documented beyond restricting Manager role access if upgrade is not possible.