Read the docs
TI-2021-12471 Aliases CVE-2021-32806GHSA-q3m9-9fj2-mfwr

URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal

Priority LOW 31CWE-601Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-601.

Summary

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerability. Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like `https://example.org` is not in the portal. The url `https:example.org` without slashes is considered to be in the portal. When redirecting, some browsers go to `https://example.org`, others give an error. Attackers may use this to redirect victims to their site, especially as part of a phishing attack. The problem has been patched in Products.isurlinportal 1.2.0.

Why it matters now

EPSS 0.01028 63rd percentileScored 2026-11-07
Fix Fixed Products.isurlinportal (plone): 1.2.0Products.isurlinportal (PyPI): 1.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ploneProducts.isurlinportalbefore 1.2.01.2.0Patch availableCNA
—Products.isurlinportal (PyPI)before 1.2.01.2.0Patch availableGHSA-q3m9-9fj2-mfwr
  • Products.isurlinportal Vendorplone Affected before 1.2.0 Fixed in 1.2.0 Patch available CNA
  • Products.isurlinportal (PyPI) Vendor— Affected before 1.2.0 Fixed in 1.2.0 Patch available GHSA-q3m9-9fj2-mfwr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:plone:isurlinportal:*:*:*:*:*:plone:*:*before 1.2.0Vulnerableplone
  • cpe:2.3:a:plone:isurlinportal:*:*:*:*:*:plone:*:* Versions before 1.2.0 Vulnerable ·plone

Remediation

  • Fix · CNA Products.isurlinportal (plone) Fixed in 1.2.0
  • Fix · GHSA-q3m9-9fj2-mfwr Products.isurlinportal (PyPI) Fixed in 1.2.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32806
  2. 2026-10-03 Alias added: GHSA-q3m9-9fj2-mfwr

References

Patch 1

Advisory 3

Other 2

  • TI-2026-22687 Products.isurlinportal: Possible open redirect when using more than 2 forward slashes CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences