CVE-2020-7936

Vulnerability

Plone versions 4.0 through 5.2.1 contain an open redirect vulnerability on the login form and potentially other locations where redirects are performed [1][3]. The vulnerability arises because the isURLInPortal check, which is designed to prevent redirects to external sites, can be bypassed to accept malicious links [3].

Exploitation

An attacker can craft a link to a Plone site that, when followed and after the user logs in, redirects the user to an attacker-controlled site [1]. The attack does not require authentication before the redirect; the user only needs to follow the crafted link and authenticate on the legitimate Plone site [1]. The vulnerability is present in all supported Plone versions and likely also affects earlier, unsupported versions [3].

Impact

Successful exploitation can lead to phishing attacks, where users are tricked into visiting a malicious site after logging in, potentially exposing credentials or other sensitive information [1][3]. The redirect could also be used for open redirect attacks, such as those used in social engineering or to bypass URL-based security controls.

Mitigation

A security hotfix (20200121) was released on January 21, 2020, to address this issue, along with other security vulnerabilities [3][4]. Users should apply the hotfix immediately or upgrade to a patched version. The CVE identifier for this specific open redirect is CVE-2020-7936 [4]. No workarounds are mentioned beyond applying the patch.