First published: Wed Jun 26 2013(Updated: )
A file system path exposure flaw was found in the way Plone, a user friendly and powerful content management system, used to present certain error messages in the wysiwyg component. A remote attacker could provide a specially-crafted URL that, when processed would lead to exposure of file system path (for the selected component) of the Plone instance.
Credit: secalert@redhat.com
Affected Software | Affected Version | How to fix |
---|---|---|
pip/plone | >=4.3<4.3.2 | 4.3.2 |
pip/plone | >=4.2<4.2.6 | 4.2.6 |
pip/plone | >=2.1<=4.1 | 4.1.1 |
Plone CMS | =4.3 | |
Plone CMS | =4.3.1 | |
Plone CMS | =4.2 | |
Plone CMS | =4.2.1 | |
Plone CMS | =4.2.2 | |
Plone CMS | =4.2.3 | |
Plone CMS | =4.2.4 | |
Plone CMS | =4.2.5 | |
Plone CMS | =2.1 | |
Plone CMS | =2.1.1 | |
Plone CMS | =2.1.2 | |
Plone CMS | =2.1.3 | |
Plone CMS | =2.1.4 | |
Plone CMS | =2.5 | |
Plone CMS | =2.5.1 | |
Plone CMS | =2.5.2 | |
Plone CMS | =2.5.3 | |
Plone CMS | =2.5.4 | |
Plone CMS | =2.5.5 | |
Plone CMS | =3.0 | |
Plone CMS | =3.0.1 | |
Plone CMS | =3.0.2 | |
Plone CMS | =3.0.3 | |
Plone CMS | =3.0.4 | |
Plone CMS | =3.0.5 | |
Plone CMS | =3.0.6 | |
Plone CMS | =3.1 | |
Plone CMS | =3.1.1 | |
Plone CMS | =3.1.2 | |
Plone CMS | =3.1.3 | |
Plone CMS | =3.1.4 | |
Plone CMS | =3.1.5.1 | |
Plone CMS | =3.1.6 | |
Plone CMS | =3.1.7 | |
Plone CMS | =3.2 | |
Plone CMS | =3.2.1 | |
Plone CMS | =3.2.2 | |
Plone CMS | =3.2.3 | |
Plone CMS | =3.3 | |
Plone CMS | =3.3.1 | |
Plone CMS | =3.3.2 | |
Plone CMS | =3.3.3 | |
Plone CMS | =3.3.4 | |
Plone CMS | =3.3.5 | |
Plone CMS | =4.0 | |
Plone CMS | =4.0.1 | |
Plone CMS | =4.0.2 | |
Plone CMS | =4.0.3 | |
Plone CMS | =4.0.4 | |
Plone CMS | =4.0.5 | |
Plone CMS | =4.0.6.1 | |
Plone CMS | =4.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2013-4194 has a moderate severity level due to its potential for file system path exposure.
To fix CVE-2013-4194, upgrade to Plone version 4.3.2 or later, or 4.2.6 or later.
CVE-2013-4194 affects Plone versions prior to 4.3.2 and 4.2.6, including 4.1.1 and earlier.
Yes, a remote attacker can exploit CVE-2013-4194 by sending specially crafted URLs.
CVE-2013-4194 exposes file system paths through improperly handled error messages in the WYSIWYG component.