Skip to content
Log inStart free trial

GHSA-jjvw-3h9j-p7jf CVE-2013-4197 PYSEC-2014-61

Plone Improper Access Control Vulnerability

High PyPI
Severity
0.0 / 10
High · CVSS 4.0
Exploit chance (EPSS)
1.26%
Chance of exploitation in the next 30 days. Higher than 69.55% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-284 Improper Access Control
Fix
4.1.1
Upgrade plone to this version or later

Description

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.

Affected versions

PyPI

PackageVulnerableFixed in
plone
>= 2.1, < 4.1.1
4.1.1
plone
>= 4.2, < 4.2.6
4.2.6
plone
>= 4.3, < 4.3.2
4.3.2
plone
>= 2.1, < 4.1.1
>= 4.2, < 4.2.6
>= 4.3, < 4.3.2
4.1.1
4.2.6
4.3.2

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

plone PyPI → 4.1.1

pip
pip install --upgrade "plone>=4.1.1"
poetry
poetry add "plone>=4.1.1"
uv
uv add "plone>=4.1.1"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
Low
User interaction
None
Confidentiality (vulnerable system)
None
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 8.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Weakness

CWE-284: Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

How to prevent it
  • Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
  • Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-xg5p-8wg5-rhxm
Phone information disclosure vulnerability
High Also affects plone
GHSA-5xfx-55x4-j223
Cross-Frame Scripting vulnerability has been found on Plone CMS
High Also affects plone
GHSA-47p5-p3jw-w78w
Server-Side Request Forgery in Plone CMS
High Also affects plone
GHSA-cvwc-g7fw-7xrj
Plone XSS Vulnerability
Medium Also affects plone
GHSA-pwgm-jvqv-6v8p
Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable
High Also affects plone
GHSA-46f9-f8jm-mw2x
Plone Cross-site Scripting vulnerability in the LiveSearch module
Medium Also affects plone
GHSA-hjp5-hv33-q58g
Plone credentials stored in session cookie
Medium Also affects plone
GHSA-593c-j348-f3gv
Plone Improper Session Management
High Also affects plone
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor