CVE-2013-7061

Advisory

Plone 4.3.3 includes a fix for CVE-2013-7061: Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Products/CMFPlone/CatalogTool.py in Plone 3.3 through 4.3.2 allows remote administrators to bypass restrictions and obtain sensitive information via an unspecified search API.


MLIST:[oss-security] 20131210 CVE request for Plone: http://www.openwall.com/lists/oss-security/2013/12/10/15
MLIST:[oss-security] 20131211 Re: CVE request for Plone: http://www.openwall.com/lists/oss-security/2013/12/12/3
CONFIRM:https://plone.org/security/20131210/catalogue-exposure: https://plone.org/security/20131210/catalogue-exposure

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7061
• https://plone.org/security/20131210/catalogue-exposure
• http://www.openwall.com/lists/oss-security/2013/12/12/3
• http://www.openwall.com/lists/oss-security/2013/12/10/15