CVE-2013-4195: Input Validation
An open redirect flaw was found in multiple components of Plone, a user friendly and powerful content management system. Remote attacker could provide a specially-crafted URL that when visited by valid Plone user could lead the Plone user's session to be redirected to external site.
Other sources
Multiple open redirect vulnerabilities in (1) marmosetpatch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4195?
CVE-2013-4195 has been assigned a medium severity rating due to its potential to redirect users to malicious external websites.
How do I fix CVE-2013-4195?
To fix CVE-2013-4195, upgrade to the latest version of Plone, as it includes patches that address this vulnerability.
What versions of Plone are affected by CVE-2013-4195?
CVE-2013-4195 affects Plone versions 2.1 through 4.3.1.
Can CVE-2013-4195 be exploited remotely?
Yes, CVE-2013-4195 can be exploited remotely by an attacker through specially-crafted URLs.
What actions can be taken to mitigate CVE-2013-4195?
In addition to upgrading Plone, ensure that input validation is implemented to prevent open redirect attacks.