High severityNVD Advisory· Published Mar 11, 2014· Updated Jun 16, 2026
CVE-2013-4193
CVE-2013-4193
Description
typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
PlonePyPI | >= 2.1, < 4.1.1 | 4.1.1 |
PlonePyPI | >= 4.2, < 4.2.6 | 4.2.6 |
PlonePyPI | >= 4.3, < 4.3.2 | 4.3.2 |
Affected products
53cpe:2.3:a:plone:plone:2.1:*:*:*:*:*:*:*+ 51 more
- cpe:2.3:a:plone:plone:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:2.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:2.5:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:2.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:2.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.2:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.0.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*
- cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
7- plone.org/products/plone-hotfix/releases/20130618nvdPatchWEB
- plone.org/products/plone/security/advisories/20130618-announcementnvdVendor AdvisoryWEB
- github.com/advisories/GHSA-6fgf-x7wg-hp8rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2013-4193ghsaADVISORY
- seclists.org/oss-sec/2013/q3/261nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-57.yamlghsaWEB
News mentions
0No linked articles in our index yet.