Vulnerability in Plone

CVE-2013-4191

zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.

EPSS: 0.012 (64.8th percentile) — read the EPSS interpretation.

Affected products

  • Plone — versions 4.3, 4.3.1, 4.2
  • N/a — versions n/a

Weakness classification (CWE)

References