CVE-2013-4196
The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request.
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- plone:plone
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-qphh-5fv5-2mjj | PyPI | plone | >=2.1 <4.1.1 | 4.1.1 |
| GHSA-qphh-5fv5-2mjj | PyPI | plone | >=4.2 <4.2.6 | 4.2.6 |
| GHSA-qphh-5fv5-2mjj | PyPI | plone | >=4.3 <4.3.2 | 4.3.2 |
| PYSEC-2014-60 | PyPI | plone | >=2.1 <4.1.1 >=4.2 <4.2.6 >=4.3 <4.3.2 | 4.1.1, 4.2.6, 4.3.2 |