Skip to content
OpenAdvisories
High · 8.8 CVE-2020-28735 EUVD-2020-0141GHSA-x7wf-5mjc-6x76PYSEC-2020-247PYSEC-2026-2881PYSEC-2026-2884PYSEC-2026-2887PYSEC-2026-737

SSRF attacks via tracebacks in Plone

Published Dec 30, 2020 · Updated Aug 4, 2024 · Assigned by mitre

Package: plone Package: plone-app-dexterity Package: plone-app-event Package: plone-app-theming Package: plone-supermodel Ecosystem: PyPI

Description

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI plone < 5.2.3 5.2.3 GHSA-x7wf-5mjc-6x76
PyPI plone-app-dexterity < 2.6.8 2.6.8 GHSA-x7wf-5mjc-6x76
PyPI plone-app-event < 3.2.10 3.2.10 GHSA-x7wf-5mjc-6x76
PyPI plone-app-theming < 4.1.6 4.1.6 GHSA-x7wf-5mjc-6x76
PyPI plone-supermodel < 1.6.3 1.6.3 GHSA-x7wf-5mjc-6x76

References