CVE-2013-4194

Advisory

Plone 4.1, 4.2.5 and 4.3.1 include a fix for CVE-2013-4194: The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message.


MLIST:[oss-security] 20130801 Re: CVE Request -- Plone: 20130618 Hotfix (multiple vectors): http://seclists.org/oss-sec/2013/q3/261
CONFIRM:http://plone.org/products/plone-hotfix/releases/20130618: http://plone.org/products/plone-hotfix/releases/20130618
CONFIRM:http://plone.org/products/plone/security/advisories/20130618-announcement: http://plone.org/products/plone/security/advisories/20130618-announcement
CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=978470: https://bugzilla.redhat.com/show_bug.cgi?id=978470

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4194
• http://plone.org/products/plone/security/advisories/20130618-announcement
• http://plone.org/products/plone-hotfix/releases/20130618
• http://seclists.org/oss-sec/2013/q3/261
• https://bugzilla.redhat.com/show_bug.cgi?id=978470