VYPR
← All advisories
High severityNVD Advisory· Published Mar 11, 2014· Updated May 6, 2026

CVE-2013-4193

CVE-2013-4193

Description

Plone's typeswidget.py fails to enforce immutable field settings, allowing anonymous attackers to hide form fields via crafted URLs.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Plone's typeswidget.py fails to enforce immutable field settings, allowing anonymous attackers to hide form fields via crafted URLs.

Vulnerability

The vulnerability resides in typeswidget.py in Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1. The code does not properly enforce the immutable setting on content edit forms, allowing fields that should be immutable to be hidden via a crafted URL [1][2].

Exploitation

An anonymous remote attacker can exploit this by sending a specially crafted URL to a vulnerable Plone site. No authentication or special privileges are required. The attacker can hide specific fields on content edit forms, potentially altering the form's behavior for other users [1].

Impact

Successful exploitation allows the attacker to hide fields on content edit forms. This could lead to integrity issues by concealing important fields from editors or administrators, potentially causing data loss or misconfiguration. The attacker does not gain elevated privileges but can manipulate the form's appearance [1][2].

Mitigation

The Plone Security Team released a hotfix on June 18, 2013 (20130618 Hotfix) that addresses this vulnerability [1]. Users should apply the hotfix or upgrade to a version that includes the fix (e.g., Plone 4.3.2 or later). No workaround is documented in the available references [2].

References
  1. oss-sec: Re: CVE Request -- Plone: 20130618 Hotfix (multiple vectors)
  2. NVD - CVE-2013-4193

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
PlonePyPI
>= 2.1, < 4.1.14.1.1
PlonePyPI
>= 4.2, < 4.2.64.2.6
PlonePyPI
>= 4.3, < 4.3.24.3.2

Affected products

53
  • Plone (software)/Plone52 versions
    cpe:2.3:a:plone:plone:2.1:*:*:*:*:*:*:*+ 51 more
    • cpe:2.3:a:plone:plone:2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:pypi/plone
    Range: >= 2.1, < 4.1.1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.