CVE-2013-4188: Medium severity Plone plone vulnerability
A denial of service flaw was found in the way Plone, a user friendly and powerful content management system, performed particular resource related information retrieval in certain cases (request interaction with internal traversal machinery). A remote attacker, having administrator privilege to certain subset of Plone action screens / functionality, could use this flaw to cause uncontrolled resource consumption (infinite loop) by issuing a specially-crafted request.
Other sources
traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite loop and resource consumption) via unspecified vectors related to "retrieving information for certain resources."
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4188?
CVE-2013-4188 is classified as a denial of service vulnerability affecting Plone versions 2.1, 2.5, and 4.3.
How do I fix CVE-2013-4188?
To fix CVE-2013-4188, upgrade to Plone version 4.1.1, 4.2.6, or 4.3.2 depending on your current version.
Which versions of Plone are affected by CVE-2013-4188?
CVE-2013-4188 affects Plone versions 2.1, 2.5, and all versions from 4.0 up to 4.3.
Can I exploit CVE-2013-4188 remotely?
Yes, CVE-2013-4188 can be exploited by a remote attacker with administrator privileges.
Is there a patch available for CVE-2013-4188?
Yes, a patch is included in the updated versions of Plone that address the vulnerability.