Description
An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | plone | >= 4.0, < 4.3.20 | 4.3.20 | GHSA-82j9-wfcf-9v2h |
| PyPI | plone | >= 5.0rc1, < 5.1.7 | 5.1.7 | GHSA-82j9-wfcf-9v2h |
| PyPI | plone | >= 5.2.0, < 5.2.2 | 5.2.2 | GHSA-82j9-wfcf-9v2h |
| PyPI | plone | >= 4.0, < 5.2.2 | 5.2.2 | PYSEC-2020-85 |