VYPR
← All advisories
High severityNVD Advisory· Published Mar 11, 2014· Updated May 6, 2026

CVE-2013-4197

CVE-2013-4197

Description

Authenticated Plone users could modify or delete other users' portraits via member_portrait.py (CVE-2013-4197).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Authenticated Plone users could modify or delete other users' portraits via member_portrait.py (CVE-2013-4197).

Vulnerability

A vulnerability in member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors [1][2]. The issue affects the portrait management functionality where insufficient access control checks are performed.

Exploitation

An attacker must be an authenticated user on the Plone site. Using unspecified vectors [1][2], the attacker can target portrait operations on other users' accounts, possibly through crafted requests to the member_portrait.py endpoint.

Impact

Successful exploitation allows the attacker to modify or delete portraits of arbitrary other users. This impacts the integrity and availability of user profile images, potentially defacing profiles or removing portrait data [1][2]. No privilege escalation is implied; the authenticated user performs actions on others' portraits without proper authorization.

Mitigation

Plone released a hotfix on 2013-06-18 that addresses this issue; upgrading to a patched version or applying the hotfix is recommended [1][2]. The vulnerability is fixed in Plone versions 4.2.6 and 4.3.2. No workarounds are documented other than applying the hotfix or upgrading.

References
  1. oss-sec: Re: CVE Request -- Plone: 20130618 Hotfix (multiple vectors)
  2. NVD - CVE-2013-4197

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
PlonePyPI
>= 2.1, < 4.1.14.1.1
PlonePyPI
>= 4.2, < 4.2.64.2.6
PlonePyPI
>= 4.3, < 4.3.24.3.2

Affected products

53
  • Plone (software)/Plone52 versions
    cpe:2.3:a:plone:plone:2.1:*:*:*:*:*:*:*+ 51 more
    • cpe:2.3:a:plone:plone:2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:2.5.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.0.6:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.5.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.6:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.1.7:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:3.3.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.0.6.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2.1:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2.2:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.2.5:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.3:*:*:*:*:*:*:*
    • cpe:2.3:a:plone:plone:4.3.1:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:pypi/plone
    Range: >= 2.1, < 4.1.1

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.