CVE-2016-7137

Multiple open redirect vulnerabilities in Plone CMS 5.x through 5.0.6, 4.x through 4.3.11, and 3.3.x through 3.3.6 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the referer parameter to (1) %2b%2bgroupdashboard%2b%2bplone.dashboard1%2bgroup/%2b/portlets.Actions or (2) folder/%2b%2bcontextportlets%2b%2bplone.footerportlets/%2b /portlets.Actions or the (3) came_from parameter to /login_form.

• CWE-601

• http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/Oct/80Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2016/09/05/4Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/09/05/5Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/archive/1/539572/100/0/threaded
• http://www.securityfocus.com/bid/92752
• https://plone.org/security/hotfix/20160830/open-redirection-in-ploneVendor Advisory
• http://packetstormsecurity.com/files/139110/Plone-CMS-4.3.11-5.0.6-XSS-Traversal-Open-Redirection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/Oct/80Third Party Advisory, VDB Entry
• http://www.openwall.com/lists/oss-security/2016/09/05/4Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/09/05/5Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/archive/1/539572/100/0/threaded
• http://www.securityfocus.com/bid/92752
• https://plone.org/security/hotfix/20160830/open-redirection-in-ploneVendor Advisory

Published

Mar 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-7131ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 a…7.5
• CVE-2016-7132ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 a…7.5
• CVE-2016-7133Zend/zend_alloc.c in PHP 7.x before 7.0.10, when open_basedi…
• CVE-2016-7134ext/curl/interface.c in PHP 7.x before 7.0.10 does not work …
• CVE-2016-7135Directory traversal vulnerability in Plone CMS 5.x through 5…
• CVE-2016-7136z3c.form in Plone CMS 5.x through 5.0.6 and 4.x through 4.3.…
• CVE-2016-7138Cross-site scripting (XSS) vulnerability in the URL checking…
• CVE-2016-7139Cross-site scripting (XSS) vulnerability in an unspecified p…
• CVE-2016-7140Multiple cross-site scripting (XSS) vulnerabilities in the Z…
• CVE-2016-7141curl and libcurl before 7.50.2, when built with NSS and the …
• CVE-2016-7142The m_sasl module in InspIRCd before 2.0.23, when used with …
• CVE-2016-7143The m_authenticate function in modules/m_sasl.c in Charybdis…