CVE-2020-7936

An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.

• CWE-601

• http://www.openwall.com/lists/oss-security/2020/01/24/1Third Party Advisory
• https://plone.org/security/hotfix/20200121Vendor Advisory
• https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-placesVendor Advisory
• https://www.openwall.com/lists/oss-security/2020/01/22/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/01/24/1Third Party Advisory
• https://plone.org/security/hotfix/20200121Vendor Advisory
• https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-placesVendor Advisory
• https://www.openwall.com/lists/oss-security/2020/01/22/1Mailing List, Third Party Advisory

Published

Jan 23, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-7928A user authorized to perform database queries may trigger a …6.5
• CVE-2020-7929A user authorized to perform database queries may trigger de…6.5
• CVE-2020-7931In JFrog Artifactory 5.x and 6.x, insecure FreeMarker templa…8.8
• CVE-2020-7932OMERO.web before 5.6.3 optionally allows sensitive data elem…5.7
• CVE-2020-7934In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name…5.4
• CVE-2020-7935Artica Pandora FMS through 7.42 is vulnerable to remote PHP …7.2
• CVE-2020-7937An XSS issue in the title field in Plone 5.0 through 5.2.1 a…5.4
• CVE-2020-7938plone.restapi in Plone 5.2.0 through 5.2.1 allows users with…8.8
• CVE-2020-7939SQL Injection in DTML or in connection objects in Plone 4.0 …8.8
• CVE-2020-7940Missing password strength checks on some forms in Plone 4.3 …7.5
• CVE-2020-7941A privilege escalation issue in plone.app.contenttypes in Pl…9.8
• CVE-2020-7942Previously, Puppet operated on a model that a node with a va…6.5