GitHub Advisoryadvisory · PyPI

GHSA-qphh-5fv5-2mjj Plone is vulnerable to information exposure via the object manager implementation

MEDIUM Published 2022-05-17 Modified 2024-10-18 Official page ↗
Aliases
CVE-2013-4196
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2023-08-29

Affected packages

• PyPI Plone: >= 2.1, < 4.1.1 → fixed in 4.1.1 • PyPI Plone: >= 4.2, < 4.2.6 → fixed in 4.2.6 • PyPI Plone: >= 4.3, < 4.3.2 → fixed in 4.3.2

Description

The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request.

Related

Alias · CVE (1)

  • CVE-2013-4196 The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References