Permissions, Privileges, and Access Controls in Plone - CVE-2013-4198
Published: March 11, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU41940
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2013-4198
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Plone
Affected software:
Plone
Plone
Detailed vulnerability description
The vulnerability allows a remote #AU# to manipulate data.
mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality.
How to mitigate CVE-2013-4198
Install update from vendor's website.