Description

typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL.

Remediation

References

CVE-2013-4193

Related Vulnerabilities

Atlassian Jira Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-4318)

TYPO3 Improper Input Validation Vulnerability (CVE-2010-4068)

WordPress Plugin WP-UserOnline Cross-Site Scripting (2.88.0)

PostgreSQL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-16850)

SugarCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14974)

Severity

Medium

Tags

Missing Update Known Vulnerabilities CWE-264 CVE-2013-4193