~ / search / GHSA-mm32-jw73-9227

GHSA-mm32-jw73-9227

Plone is vulnerable to File System Path Exposure

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-4194

Packages

EcosystemPackageAffectedFixed in
PyPI Plone >= 2.1, < 4.1.1 4.1.1
PyPI Plone >= 4.2, < 4.2.6 4.2.6
PyPI Plone >= 4.3, < 4.3.2 4.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

The WYSIWYG component (wysiwyg.py) in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers to obtain sensitive information via a crafted URL, which reveals the installation path in an error message.

References

External links from the advisory. They lead to third-party sites.