CVE-2013-4189: Medium severity Plone plone vulnerability
A privilege escalation flaw was found in the way Plone, a user friendly and powerful content management system, enforced authorization for users having administrator privilege access for a subtree of a particular node (access to node above that subtree was granted even when the user in question has had administrator privilege only for a subtree of that node). A remote attacker, with administrator user privilege to certain subtree of Plone actions / functionality, could use this flaw to access / alter also higher nodes.
Other sources
Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors.
— GitHub
Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users with administrator access to a subtree to access nodes above the subtree via unknown vectors.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4189?
CVE-2013-4189 is rated as a medium severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2013-4189?
To fix CVE-2013-4189, upgrade Plone to version 4.3.2 or 4.2.6.
What software versions are affected by CVE-2013-4189?
CVE-2013-4189 affects Plone versions 2.1 through 4.3.1.
What kind of vulnerability is CVE-2013-4189?
CVE-2013-4189 is a privilege escalation vulnerability allowing unauthorized access to certain user privileges.
Is there a patch available for CVE-2013-4189?
Yes, patches are available through Plone version updates.