The Plone security team has received a report about a vulnerability in the 'is url in portal' check. This check is mostly used to make sure Plone does not redirect to external sites, because this could lead to phishing attacks.
The check could be circumvented by urls like https:example.org without slashes. Not all browsers treat this the same though.
The vulnerability was fixed in version 1.2.0 of Products.isurlinportal. You should already be using a version of this package in your Plone Site (4.3 or higher). An upgrade to the new version is recommended for all.
This vulnerability was discovered and reported by Yuji Tounai of Mitsui Bussan Secure Directions, Inc. Thank you!
See the advisory on GitHub.