Permissions, Privileges, and Access Controls in Plone - CVE-2013-4198
Published: March 11, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU41940
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-4198
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote #AU# to manipulate data.
mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality.
Affected software
Plone
How to mitigate CVE-2013-4198
Install update from vendor's website.