Description

The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request.

Remediation

References

CVE-2013-4196

Related Vulnerabilities

phpMyAdmin Improper Input Validation Vulnerability (CVE-2006-6943)

Jenkins Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-2230)

Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-2183)

WordPress Plugin Woody ad snippets-Insert Header Footer Code, AdSense Ads Cross-Site Request Forgery (2.3.9)

Oracle HTTP Server CVE-2014-0098 Vulnerability (CVE-2014-0098)

Severity

Medium

Classification

CVE-2013-4196 CWE-264

Tags

Missing Update Known Vulnerabilities