RETIRED: Plone Multiple Remote Security Vulnerabilities
BID:61544
Info
RETIRED: Plone Multiple Remote Security Vulnerabilities
| Bugtraq ID: | 61544 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 31 2013 12:00AM |
| Updated: | Aug 26 2013 12:20AM |
| Credit: | Matthew Wilkes |
| Vulnerable: |
Plone Plone 4.1.3 Plone Plone 4.0.8 Plone Plone 4.0.7 Plone Plone 3.3.5 Plone Plone 3.3.5 Plone Plone 3.3.4 Plone Plone 3.3.3 Plone Plone 3.3.2 Plone Plone 3.3.1 Plone Plone 3.2.3 Plone Plone 3.2.2 Plone Plone 3.1.6 Plone Plone 3.1.4 Plone Plone 3.0.5 Plone Plone 3.0.4 Plone Plone 3.0.3 Plone Plone 3.0.2 Plone Plone 3.0.1 Plone Plone 2.5.5 Plone Plone 2.5.4 Plone Plone 2.5.1 Plone Plone 2.1.2 Plone Plone 2.0.5 Plone Plone 2.0.4 Plone Plone 4.2a2 Plone Plone 4.2a1 Plone Plone 4.2 Plone Plone 4.1 Plone Plone 4.0.9 Plone Plone 4.0.6.1 Plone Plone 4.0.5 Plone Plone 4.0.4 Plone Plone 4.0.3 Plone Plone 4.0.2 Plone Plone 4.0.1 Plone Plone 4.0 Plone Plone 3.3.2 Plone Plone 3.3.1 Plone Plone 3.3 Plone Plone 3.3 Plone Plone 3.2.3 Plone Plone 3.2.2 Plone Plone 3.2.1 Plone Plone 3.2 Plone Plone 3.1.7 Plone Plone 3.1.6 Plone Plone 3.1.5.1 Plone Plone 3.1.3 Plone Plone 3.1.2 Plone Plone 3.1.1 Plone Plone 3.1 Plone Plone 3.0.6 Plone Plone 3.0 Plone Plone 2.5-beta1 Plone Plone 2.5 Plone Plone 2.1.3 Plone Plone 2.1.1 Plone Plone 2.1 Plone Plone 2.0.2 Plone Plone 2.0.1 Plone Plone 2.0 Plone Plone 1.0.6 Plone Plone 1.0.5 Plone Plone 1.0.4 Plone Plone 1.0.3 Plone Plone 1.0.2 Plone Plone 1.0.1 |
| Not Vulnerable: | |
Discussion
RETIRED: Plone Multiple Remote Security Vulnerabilities
Plone is prone to multiple security vulnerabilities.
Attackers can exploit these issues to bypass certain security restrictions, steal cookie-based authentication credentials, insert malicious HTML and script codes, obtain potentially sensitive information, redirect user to conduct phishing attacks, or cause denial-of-service conditions. Other attacks are possible.
This BID is being retired. The following individual records exist to better document the issues:
61944 Plone CVE-2013-4188 Remote Denial of Service Vulnerability
61947 Plone CVE-2013-4189 Multiple Security Bypass Vulnerabilities
61953 Plone CVE-2013-4190 Multiple Cross-Site Scripting Vulnerabilities
61952 Plone CVE-2013-4191 Information Disclosure Vulnerability
61955 Plone CVE-2013-4192 Content Spoofing Vulnerability
61962 Plone 'typeswidget.py' CVE-2013-4193 Security Bypass Vulnerability
61956 Plone CVE-2013-4194 Information Disclosure Vulnerability
61959 Plone CVE-2013-4195 Multiple Open Redirection Vulnerabilities
61954 Plone CVE-2013-4196 Multiple Information Disclosure Vulnerabilities
61957 Plone CVE-2013-4197 Security Bypass Vulnerability
61958 Plone 'mail_password.py' Access Bypass Vulnerability
61961 Plone CVE-2013-4199 Multiple Remote Denial of Service Vulnerabilities
61964 Plone 'in_portal.py' CVE-2013-4200 Session Hijacking Vulnerability
Plone is prone to multiple security vulnerabilities.
Attackers can exploit these issues to bypass certain security restrictions, steal cookie-based authentication credentials, insert malicious HTML and script codes, obtain potentially sensitive information, redirect user to conduct phishing attacks, or cause denial-of-service conditions. Other attacks are possible.
This BID is being retired. The following individual records exist to better document the issues:
61944 Plone CVE-2013-4188 Remote Denial of Service Vulnerability
61947 Plone CVE-2013-4189 Multiple Security Bypass Vulnerabilities
61953 Plone CVE-2013-4190 Multiple Cross-Site Scripting Vulnerabilities
61952 Plone CVE-2013-4191 Information Disclosure Vulnerability
61955 Plone CVE-2013-4192 Content Spoofing Vulnerability
61962 Plone 'typeswidget.py' CVE-2013-4193 Security Bypass Vulnerability
61956 Plone CVE-2013-4194 Information Disclosure Vulnerability
61959 Plone CVE-2013-4195 Multiple Open Redirection Vulnerabilities
61954 Plone CVE-2013-4196 Multiple Information Disclosure Vulnerabilities
61957 Plone CVE-2013-4197 Security Bypass Vulnerability
61958 Plone 'mail_password.py' Access Bypass Vulnerability
61961 Plone CVE-2013-4199 Multiple Remote Denial of Service Vulnerabilities
61964 Plone 'in_portal.py' CVE-2013-4200 Session Hijacking Vulnerability
Exploit / POC
RETIRED: Plone Multiple Remote Security Vulnerabilities
Some of these issues can be exploited through a browser. To exploit multiple cross-site scripting vulnerabilities and the open-redirection vulnerability an attacker must entice an unsuspecting victim to follow a malicious URI.
Some of these issues can be exploited through a browser. To exploit multiple cross-site scripting vulnerabilities and the open-redirection vulnerability an attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
RETIRED: Plone Multiple Remote Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.