~ / search / GHSA-6fgf-x7wg-hp8r

GHSA-6fgf-x7wg-hp8r

Plone Unrestricted Filed Manipulation vulnerability via content edit forms

Source: GitHub Advisory Database (reviewed) High CVE-2013-4193

Packages

EcosystemPackageAffectedFixed in
PyPI Plone >= 2.1, < 4.1.1 4.1.1
PyPI Plone >= 4.2, < 4.2.6 4.2.6
PyPI Plone >= 4.3, < 4.3.2 4.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL.

References

External links from the advisory. They lead to third-party sites.