Vulnerability Description
typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Plone | Plone | 2.1 |
Related Weaknesses (CWE)
References
- http://plone.org/products/plone-hotfix/releases/20130618Patch
- http://plone.org/products/plone/security/advisories/20130618-announcementVendor Advisory
- http://seclists.org/oss-sec/2013/q3/261
- https://bugzilla.redhat.com/show_bug.cgi?id=978469
- http://plone.org/products/plone-hotfix/releases/20130618Patch
- http://plone.org/products/plone/security/advisories/20130618-announcementVendor Advisory
- http://seclists.org/oss-sec/2013/q3/261
- https://bugzilla.redhat.com/show_bug.cgi?id=978469
FAQ
What is CVE-2013-4193?
CVE-2013-4193 is a vulnerability with a CVSS score of 4.3 (MEDIUM). typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers t...
How severe is CVE-2013-4193?
CVE-2013-4193 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-4193?
Check the references section above for vendor advisories and patch information. Affected products include: Plone Plone.