GHSA-w3pw-qxjj-6prr CVE-2013-4188 PYSEC-2014-52

Plone Authenticated Denial of Service vulnerability

Medium PyPI

Severity: 0.0 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): 1.35%; Chance of exploitation in the next 30 days. Higher than 71.48% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-400 Uncontrolled Resource Consumption
Fix: 4.3.2; Upgrade plone to this version or later

Description

traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite loop and resource consumption) via unspecified vectors related to "retrieving information for certain resources."

Affected versions

PyPI

Package	Vulnerable	Fixed in
plone	`>= 4.3, < 4.3.2`	`4.3.2`
plone	`>= 4.2, < 4.2.6`	`4.2.6`
plone	`>= 2.1, < 4.1.1`	`4.1.1`
plone	`>= 2.1, < 4.1.1` `>= 4.2, < 4.2.6` `>= 4.3, < 4.3.2`	`4.1.1` `4.2.6` `4.3.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

plone PyPI → `4.3.2`

pip

pip install --upgrade "plone>=4.3.2"

poetry

poetry add "plone>=4.3.2"

uv

uv add "plone>=4.3.2"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: Present
Privileges required: High
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): High
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.1 4.4

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: High
Privileges required: High
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-400: Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

How to prevent it

Architecture and Design: Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Architecture and Design: Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
Implementation: Ensure that all failures in resource allocation place the system into a safe posture.

References

Advisories

Packages

github.com/plone/Plone

Timeline

Mar 11, 2014 Published
Jun 10, 2026 Last updated by the source
Nov 1, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-xg5p-8wg5-rhxm Phone information disclosure vulnerability	High	Also affects plone
GHSA-5xfx-55x4-j223 Cross-Frame Scripting vulnerability has been found on Plone CMS	High	Also affects plone
GHSA-47p5-p3jw-w78w Server-Side Request Forgery in Plone CMS	High	Also affects plone
GHSA-cvwc-g7fw-7xrj Plone XSS Vulnerability	Medium	Also affects plone
GHSA-pwgm-jvqv-6v8p Plone anonymous access to sub-objects in CMFEditions where KwAsAttributes classes were publishable	High	Also affects plone
GHSA-46f9-f8jm-mw2x Plone Cross-site Scripting vulnerability in the LiveSearch module	Medium	Also affects plone
GHSA-hjp5-hv33-q58g Plone credentials stored in session cookie	Medium	Also affects plone
GHSA-593c-j348-f3gv Plone Improper Session Management	High	Also affects plone

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor