CVE-2013-4191
plone plone: no CVSS score yet. EPSS 1.2% chance of exploitation in the next 30 days. Fixed in plone 4.1.1, 4.2.6, 4.3.2.
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
- EPSS
- 1.2% chance of exploitation in the next 30 days; higher than 67% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- plone:plone
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-grwx-4p5v-9g2g | PyPI | plone | >=2.1 <4.1.1 | 4.1.1 |
| GHSA-grwx-4p5v-9g2g | PyPI | plone | >=4.2 <4.2.6 | 4.2.6 |
| GHSA-grwx-4p5v-9g2g | PyPI | plone | >=4.3 <4.3.2 | 4.3.2 |
| PYSEC-2014-55 | PyPI | plone | >=2.1 <4.1.1 >=4.2 <4.2.6 >=4.3 <4.3.2 | 4.1.1, 4.2.6, 4.3.2 |