CVE-2013-4198: Medium severity Plone plone vulnerability
mailpassword.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality.
Other sources
A security flaw was found in the way Plone, a user friendly and powerful content management system, restricted access to password change for unauthorized users. If from policy definition Plone user in question was not allowed to change their password, they (previously) could still reset / change the password via forgotten password email functionality.
— Red Hat
mailpassword.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4198?
CVE-2013-4198 has been classified as a high-severity vulnerability due to its potential exploitation by authenticated users to change passwords without proper authorization.
How do I fix CVE-2013-4198?
To fix CVE-2013-4198, upgrade to Plone version 4.3.2 or 4.2.6, or ensure you are using a version higher than 4.3.1.
Who is affected by CVE-2013-4198?
CVE-2013-4198 affects Plone versions 2.1 through 4.3.1, allowing authenticated users to exploit the vulnerability.
What types of attacks can be launched using CVE-2013-4198?
Attackers can exploit CVE-2013-4198 to change user passwords via the forgotten password email functionality, potentially gaining unauthorized access.
Is CVE-2013-4198 still an active vulnerability?
While CVE-2013-4198 was mitigated by updates, it remains a concern for systems running vulnerable versions without the necessary patches.