CVE-2013-4193: Medium severity Plone plone vulnerability
A security flaw was found in the way Plone, a user friendly and powerful content management system, enforced immutable setting on certain content edit forms. A remote attacker could use this flaw to provide a specially-crafted URL that would (in a non-persistent way) hide certain fields from these content edit forms, possibly leading to scenario such altered forms to be erroneously accepted by authenticated Plone user as valid.
Other sources
typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4193?
CVE-2013-4193 is classified as a moderate severity vulnerability due to its potential to allow an attacker to modify form fields.
How do I fix CVE-2013-4193?
To fix CVE-2013-4193, you should upgrade to a patched version of Plone that addresses this vulnerability.
What versions of Plone are affected by CVE-2013-4193?
CVE-2013-4193 affects Plone versions 2.1 through 4.3.1.
Can CVE-2013-4193 be exploited remotely?
Yes, CVE-2013-4193 can be exploited remotely through specially-crafted URLs.
Is there any data loss associated with CVE-2013-4193?
CVE-2013-4193 does not lead to persistent data loss but could temporarily hide fields during editing.