CVE-2013-4194: Infoleak
A file system path exposure flaw was found in the way Plone, a user friendly and powerful content management system, used to present certain error messages in the wysiwyg component. A remote attacker could provide a specially-crafted URL that, when processed would lead to exposure of file system path (for the selected component) of the Plone instance.
Other sources
The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4194?
CVE-2013-4194 has a moderate severity level due to its potential for file system path exposure.
How do I fix CVE-2013-4194?
To fix CVE-2013-4194, upgrade to Plone version 4.3.2 or later, or 4.2.6 or later.
Which versions of Plone are affected by CVE-2013-4194?
CVE-2013-4194 affects Plone versions prior to 4.3.2 and 4.2.6, including 4.1.1 and earlier.
Can CVE-2013-4194 be exploited remotely?
Yes, a remote attacker can exploit CVE-2013-4194 by sending specially crafted URLs.
How does CVE-2013-4194 expose file system paths?
CVE-2013-4194 exposes file system paths through improperly handled error messages in the WYSIWYG component.