Description

The object manager implementation (objectmanager.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access to internal methods, which allows remote attackers to obtain sensitive information via a crafted request.

Remediation

References

CVE-2013-4196

Related Vulnerabilities

WordPress Plugin Mitsol Social Post Feed Cross-Site Scripting (1.10)

Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-13447)

Sqlite Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-6592)

WordPress Plugin WooCommerce PHP Object Injection (3.1.0)

WordPress Plugin Related Posts by Zemanta Cross-Site Request Forgery (1.3.1)

Severity

Medium

Classification

CVE-2013-4196 CWE-264

Tags

Missing Update Known Vulnerabilities