An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1…
Priority LOW 29CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.
Summary
An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.
Why it matters now
EPSS 0.00918 60th percentileScored 2026-11-07
Fix Partial Plone (PyPI): 4.3.20, 5.1.7, 5.2.2Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | Plone (PyPI) | 4.0 to before 4.3.20 | 4.3.20 | Patch available | GHSA-82j9-wfcf-9v2h |
| — | Plone (PyPI) | 5.0rc1 to before 5.1.7 | 5.1.7 | Patch available | GHSA-82j9-wfcf-9v2h |
| — | Plone (PyPI) | 5.2.0 to before 5.2.2 | 5.2.2 | Patch available | GHSA-82j9-wfcf-9v2h |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- Plone (PyPI) Vendor— Affected 4.0 to before 4.3.20 Fixed in 4.3.20 Patch available GHSA-82j9-wfcf-9v2h
- Plone (PyPI) Vendor— Affected 5.0rc1 to before 5.1.7 Fixed in 5.1.7 Patch available GHSA-82j9-wfcf-9v2h
- Plone (PyPI) Vendor— Affected 5.2.0 to before 5.2.2 Fixed in 5.2.2 Patch available GHSA-82j9-wfcf-9v2h
Remediation
- Fix · GHSA-82j9-wfcf-9v2h Plone (PyPI) Fixed in 4.3.20 Advisory →
- Fix · GHSA-82j9-wfcf-9v2h Plone (PyPI) Fixed in 5.1.7 Advisory →
- Fix · GHSA-82j9-wfcf-9v2h Plone (PyPI) Fixed in 5.2.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7936
- 2026-10-03 Alias added: GHSA-82j9-wfcf-9v2h
References
Advisory 5
- https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places
- https://plone.org/security/hotfix/20200121
- https://www.openwall.com/lists/oss-security/2020/01/22/1
- [oss-security] 20200124 Re: Plone security hotfix 20200121
- https://nvd.nist.gov/vuln/detail/CVE-2020-7936
More Plone vulnerabilities
- TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
- TI-2021-13226 An issue in Plone CMS v. CVSS 3.1HIGH 8.8
- TI-2024-15757 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13… CVSS 3.1HIGH 7.5
- TI-2021-12911 Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted… CVSS 3.1CRITICAL 9.9
- TI-2020-17872 The official plone Docker images before version of 4.3.18-alpine (Alpine specific)… CVSS 3.1CRITICAL 9.8
- TI-2020-06422 A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-7936 · CVE Program
- CVE-2020-7936 · NVD
- FIRST EPSS
- GHSA-82j9-wfcf-9v2h · GitHub Advisory Database · CC BY 4.0
- CVE-2020-7936 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences