Description

zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.

Remediation

References

CVE-2013-4191

Related Vulnerabilities

WordPress Plugin WP Easy Poll Multiple Vulnerabilities (1.1.3)

WordPress Plugin LearnDash LMS Arbitrary File Upload (2.5.3)

MySQL CVE-2023-22079 Vulnerability (CVE-2023-22079)

MySQL CVE-2017-3329 Vulnerability (CVE-2017-3329)

WordPress Plugin Webapp builder (Free mobile apps native iPhone iOS & Android Winphone mobile apps) Arbitrary File Upload (2.0)

Severity

Medium

Classification

CVE-2013-4191 CWE-264

Tags

Missing Update Known Vulnerabilities