CVE-2013-4196: Infoleak
Multiple information exposure flaws were found in the way object manager implementation of Plone, a user friendly and powerful content management system, protected access to its internal methods. A remote attacker could issue a specially-crafted (URL) request that, when processed would lead to information exposure.
Other sources
The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4196?
CVE-2013-4196 is rated as having a moderate severity level due to information exposure that could allow remote attackers to gain unauthorized access.
How do I fix CVE-2013-4196?
To fix CVE-2013-4196, upgrade to Plone version 4.3.2 or later, 4.2.6 or later, or 4.1.1 or later.
What types of vulnerabilities does CVE-2013-4196 describe?
CVE-2013-4196 describes multiple information exposure flaws in the Plone content management system.
Which versions of Plone are affected by CVE-2013-4196?
CVE-2013-4196 affects Plone versions prior to 4.3.2, 4.2.6, and 4.1.1.
Can CVE-2013-4196 be exploited remotely?
Yes, CVE-2013-4196 can be exploited remotely by sending specially-crafted URL requests.