PT-2014-2761 · Plone Foundation · Plone

Published 2014-03-11 · Updated 2022-05-17 · CVE-2013-4198

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 2.1 through 4.1 Plone versions 4.2.x through 4.2.5 Plone versions 4.3.x through 4.3.1

Description The issue allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality. This is related to the mail password.py script.

Recommendations For Plone versions 2.1 through 4.1, update to a version that contains a fix for this issue. For Plone versions 4.2.x through 4.2.5, update to a version that contains a fix for this issue. For Plone versions 4.3.x through 4.3.1, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the forgotten password email functionality until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-264

CWE-863

Related Identifiers

CVE-2013-4198

GHSA-QJXF-6PR8-J87V

PYSEC-2014-62

Affected Products

Plone

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2013-4198 · Security Note
• http://plone.org/products/plone/security/advisories/20130618-announcement · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qjxf-6pr8-j87v · Vendor Advisory
• http://plone.org/products/plone-hotfix/releases/20130618 · Patch
• https://osv.dev/vulnerability/PYSEC-2014-62 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-62.yaml · Note
• https://github.com/plone/Plone · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=978480 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4198 · Note
• http://seclists.org/oss-sec/2013/q3/261 · Note
• https://pypi.org/project/Products.PloneHotfix20130618 · Note