HIGH 8.8 PyPI
SSRF attacks via tracebacks in Plone
GHSA-x7wf-5mjc-6x76 · CVE-2020-28735 · PYSEC-2020-247 · PYSEC-2026-2881 · PYSEC-2026-2884 · PYSEC-2026-2887 · PYSEC-2026-737
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2020-28735
- WEB https://github.com/plone/Products.CMFPlone/issues/3209
- WEB https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt
- ADVISORY https://github.com/advisories/GHSA-x7wf-5mjc-6x76
- WEB https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-247.yaml
- WEB https://www.misakikata.com/codes/plone/python-en.html
Ready to move
Start Securing
Free, no credit card | First findings in minutes