CVE-2021-32806 json
URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportal
published 5y ago modified 4mo ago also GHSA-q3m9-9fj2-mfwr , PYSEC-2021-323 , EUVD-2021-0199
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 63%
- public exploits
- 0
- none known
Summary
Products.isurlinportal is a replacement for isURLInPortal method in Plone. Versions of Products.isurlinportal prior to 1.2.0 have an Open Redirect vulnerability. Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like `https://example.org` is not in the portal. The url `https:example.org` without slashes is considered to be in the portal. When redirecting, some browsers go to `https://example.org`, others give an error. Attackers may use this to redirect victims to their site, especially as part of a phishing attack. The problem has been patched in Products.isurlinportal 1.2.0.
Patch / fix
- pypi products-isurlinportal 1.2.0
- plone isurlinportal 1.2.0
Is CVE-2021-32806 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
1.03% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | products-isurlinportal | <1.2.0 |
1.2.0 |
Affected products
- plone Products.isurlinportal
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/plone/Products.isurlinportal/commit/d4fd34990d18adf05a10dc5e2bb4b066798280ba
web, patch, third-party-advisory
-
github.com
/plone/Products.isurlinportal/security/advisories/GHSA-q3m9-9fj2-mfwr
web, third-party-advisory, advisory
-
jvn.jp
/en/jp/JVN50804280/index.html
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2021-32806
advisory
-
github.com
/plone/Products.isurlinportal
package
-
github.com
/pypa/advisory-database/tree/main/vulns/products-isurlinportal/PYSEC-2021-323.yaml
web
Sources
- CVE List CVE-2021-32806
- GitHub Advisory GHSA-q3m9-9fj2-mfwr
- NVD CVE-2021-32806
- OSV PYSEC-2021-323
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.