PT-2014-2761 · Plone Foundation · Plone

Publicado 2014-03-11 · Atualizado 2022-05-17 · CVE-2013-4198

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Média

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 2.1 through 4.1 Plone versions 4.2.x through 4.2.5 Plone versions 4.3.x through 4.3.1

Description The issue allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality. This is related to the mail password.py script.

Recommendations For Plone versions 2.1 through 4.1, update to a version that contains a fix for this issue. For Plone versions 4.2.x through 4.2.5, update to a version that contains a fix for this issue. For Plone versions 4.3.x through 4.3.1, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the forgotten password email functionality until a patch is available.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-264

CWE-863

Identificadores relacionados

CVE-2013-4198

GHSA-QJXF-6PR8-J87V

PYSEC-2014-62

Produtos afetados

Plone

Referências · 11

• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-62.yaml · Nota
• https://github.com/plone/Plone · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=978480 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4198 · Nota de Segurança
• http://plone.org/products/plone/security/advisories/20130618-announcement · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4198 · Nota
• https://osv.dev/vulnerability/GHSA-qjxf-6pr8-j87v · Aviso do Fabricante
• http://plone.org/products/plone-hotfix/releases/20130618 · Correção
• https://osv.dev/vulnerability/PYSEC-2014-62 · Aviso do Fabricante
• http://seclists.org/oss-sec/2013/q3/261 · Nota
• https://pypi.org/project/Products.PloneHotfix20130618 · Nota