Description

zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.

Remediation

References

CVE-2013-4191

Related Vulnerabilities

WordPress Plugin WordPress Photo Gallery by Gallery Bank Cross-Site Scripting (3.0.228)

Zenphoto Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-2949)

WordPress Other Vulnerability (CVE-2007-1244)

Craft CMS Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2023-32679)

WordPress Ultimate Member Plugin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-8354)

Severity

Medium

Classification

CVE-2013-4191 CWE-264

Tags

Missing Update Known Vulnerabilities