PT-2014-2759 · Plone Foundation · Plone

Publicado 2014-03-11 · Atualizado 2022-05-17 · CVE-2013-4196

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 2.1 through 4.1 Plone versions 4.2.x through 4.2.5 Plone versions 4.3.x through 4.3.1

Description The issue is related to the object manager implementation in the objectmanager.py file, which fails to properly restrict access to internal methods. This allows remote attackers to obtain sensitive information by sending a crafted request.

Recommendations For Plone versions 2.1 through 4.1, update to a version that properly restricts access to internal methods. For Plone versions 4.2.x through 4.2.5, update to a version that properly restricts access to internal methods. For Plone versions 4.3.x through 4.3.1, update to a version that properly restricts access to internal methods.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-264

CWE-200

Identificadores relacionados

CVE-2013-4196

GHSA-QPHH-5FV5-2MJJ

PYSEC-2014-60

Produtos afetados

Plone

Referências · 10

• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-60.yaml · Nota
• https://github.com/plone/Plone · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4196 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=978475 · Nota
• http://plone.org/products/plone/security/advisories/20130618-announcement · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4196 · Nota
• https://osv.dev/vulnerability/GHSA-qphh-5fv5-2mjj · Aviso do Fabricante
• http://plone.org/products/plone-hotfix/releases/20130618 · Correção
• https://osv.dev/vulnerability/PYSEC-2014-60 · Aviso do Fabricante
• http://seclists.org/oss-sec/2013/q3/261 · Nota