Detections
Analytics
SCA: security update for Plone, Products.CMFPlone (GHSA-8g72-gq68-6gqh)
medium Tenable Self-Hosted Container Security Plugin ID 432813
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a
'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried
to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You
would login, and get redirected to the site of the attacker, letting you think that you are still on the
original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks
are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on
the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were
discovered, and fixed with this hotfix. (CVE-2017-1000481)
See Also
Plugin Details
Severity: Medium
ID: 432813
Version: Revision 1.1
Type: Local
Family: SCA Checks
Published: 8/11/2025
Updated: 8/11/2025
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 8.69
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2017-1000481
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.3
Threat Score: 1.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/14/2022
Vulnerability Publication Date: 1/3/2018
Reference Information
CVE: CVE-2017-1000481
cwe: CWE-601