CVE - CVE-2013-4200

CVE-ID
CVE-2013-4200	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the "next" parameter to acl_users/credentials_cookie_auth/require_login.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:20140116 CVE-2013-4200 - Plone URL redirection / Forwarding of cookie data (session hijack) in certain browsers URL:http://www.securityfocus.com/archive/1/530787/100/0/threaded MISC:[oss-security] 20130801 Re: CVE Request -- Plone: 20130618 Hotfix (multiple URL:http://www.openwall.com/lists/oss-security/2013/08/01/2 MISC:http://plone.org/products/plone-hotfix/releases/20130618 URL:http://plone.org/products/plone-hotfix/releases/20130618 MISC:http://plone.org/products/plone/security/advisories/20130618-announcement URL:http://plone.org/products/plone/security/advisories/20130618-announcement MISC:https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4200 URL:https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4200
Assigning CNA
Red Hat, Inc.
Date Record Created
20130612	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20130612)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)