Description

The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message.

Remediation

References

CVE-2013-4194

Related Vulnerabilities

Oracle JRE Improper Access Control Vulnerability (CVE-2026-47063)

WordPress Plugin WordPress Photo Gallery by Gallery Bank Cross-Site Scripting (3.0.228)

Drupal Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-6379)

Seo Panel Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-28417)

WordPress Plugin Font-official webfonts plugin of Fonts For Web Cross-Site Scripting (7.5.1)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-200 CVE-2013-4194