CVE-2020-7936

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Jan 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-79375.4An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be exe CVE-2020-79388.8plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level.CVE-2020-79398.8SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem i CVE-2020-79407.5Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.CVE-2020-79419.8A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needi CVE-2020-79426.5Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a comprom CVE-2020-79437.5Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may conta CVE-2020-79447.7In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can resul CVE-2020-79455.5Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who shou CVE-2020-79479.8An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled CVE-2020-79488.8An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference.CVE-2020-79497.8schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming se