{"id":"CVE-2020-28735","aliases":["GHSA-x7wf-5mjc-6x76","PYSEC-2020-247","PYSEC-2026-737"],"title":"SSRF attacks via tracebacks in Plone","summary":"SSRF attacks via tracebacks in Plone","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"plone","product":"plone","ecosystem":"pip","affected":["plone < 5.2.3","plone-app-event < 3.2.10","plone-app-theming < 4.1.6","plone-app-dexterity < 2.6.8","plone-supermodel < 1.6.3"],"patched":["plone 5.2.3","plone-app-event 3.2.10","plone-app-theming 4.1.6","plone-app-dexterity 2.6.8","plone-supermodel 1.6.3"],"published":"2021-04-07","updated":"2026-07-06","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-x7wf-5mjc-6x76","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28735"},{"url":"https://github.com/plone/Products.CMFPlone/issues/3209"},{"url":"https://dist.plone.org/release/5.2.3/RELEASE-NOTES.txt"},{"url":"https://github.com/advisories/GHSA-x7wf-5mjc-6x76"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-247.yaml"},{"url":"https://www.misakikata.com/codes/plone/python-en.html"}],"tags":["osv","pip"],"epss":0.01435,"epssPercentile":0.71945,"ingestedAt":"2026-07-08T18:25:54.142Z","slug":"CVE-2020-28735","body":"## Overview\n\nPlone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).\n\n## Affected packages\n\n- `plone < 5.2.3`\n- `plone-app-event < 3.2.10`\n- `plone-app-theming < 4.1.6`\n- `plone-app-dexterity < 2.6.8`\n- `plone-supermodel < 1.6.3`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `plone 5.2.3`\n- `plone-app-event 3.2.10`\n- `plone-app-theming 4.1.6`\n- `plone-app-dexterity 2.6.8`\n- `plone-supermodel 1.6.3`","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}