CVE-2013-4193

MEDIUM5.9EPSS 0.31%

Plone Unrestricted Filed Manipulation vulnerability via content edit forms

發布日:2022/5/17修改日:2024/10/17

也稱為:GHSA-6fgf-x7wg-hp8rPYSEC-2014-57

描述

typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL.

受影響套件(2)

PyPI/plone>= 2.1, < 4.1.1
PyPI/plone>= 2.1, < 4.1.1, >= 4.2, < 4.2.6, >= 4.3, < 4.3.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
osv	CVSS 3.1	MEDIUM5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2013-4193
PATCHhttps://github.com/plone/Plone
WEBhttp://plone.org/products/plone-hotfix/releases/20130618
WEBhttp://plone.org/products/plone/security/advisories/20130618-announcement
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=978469
WEBhttp://seclists.org/oss-sec/2013/q3/261
WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-57.yaml