GitHub Advisoryadvisory · PyPI

GHSA-6fgf-x7wg-hp8r Plone Unrestricted Filed Manipulation vulnerability via content edit forms

HIGH Published 2022-05-17 Modified 2024-10-17 Official page ↗
Aliases
CVE-2013-4193
Ecosystem
PyPI
Packages
Plone
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-284
Reviewed
2023-08-29

Affected packages

• PyPI Plone: >= 2.1, < 4.1.1 → fixed in 4.1.1 • PyPI Plone: >= 4.2, < 4.2.6 → fixed in 4.2.6 • PyPI Plone: >= 4.3, < 4.3.2 → fixed in 4.3.2

Description

typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL.

Related

Alias · CVE (1)

  • CVE-2013-4193 typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References