CVE-2013-4192: Input Validation
A security flaw was found in the way Plone, a user friendly and powerful content management system, performed certain provided data validation when sending emails. A remote attacker, valid Plone user, could use this flaw to conduct email spoofing attacks.
Other sources
sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4192?
The severity of CVE-2013-4192 is considered medium due to the potential for email spoofing attacks by remote, authenticated attackers.
How do I fix CVE-2013-4192?
To fix CVE-2013-4192, upgrade Plone to version 4.3.2 or higher, or to version 4.2.6 or higher.
What versions of Plone are affected by CVE-2013-4192?
CVE-2013-4192 affects Plone versions from 2.1 through 4.1, as well as certain 4.2.x versions prior to 4.2.6.
Can CVE-2013-4192 be exploited remotely?
Yes, CVE-2013-4192 can be exploited remotely by a valid Plone user to conduct email spoofing.
Is there a hotfix available for CVE-2013-4192?
Yes, a hotfix is available for CVE-2013-4192 that addresses the data validation flaw.