CVE-2013-4191: Infoleak
An information exposure flaw was found in the way zip archives generation functionality of Plone, a user friendly and powerful content management system, enforced user access control privileges on the content to be included into the archive. A remote attacker could use this flaw to obtain sensitive information (by generating a zip archive from content they would not be otherwise able to access).
Other sources
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4191?
CVE-2013-4191 is rated as a moderate severity vulnerability due to its potential for information exposure.
How do I fix CVE-2013-4191?
To fix CVE-2013-4191, upgrade Plone to version 4.3.2, 4.2.6, or 4.1.1 as per the recommended patches.
Which versions of Plone are affected by CVE-2013-4191?
CVE-2013-4191 affects Plone versions 4.3, 4.2, and earlier versions down to 2.1.
Can CVE-2013-4191 allow unauthorized users to access data?
Yes, CVE-2013-4191 can allow remote attackers to retrieve sensitive information from Plone due to improper access control.
What types of systems are vulnerable to CVE-2013-4191?
CVE-2013-4191 affects systems utilizing the Plone content management system versions specified in the vulnerability report.