CVE-2013-4198

Published: Mar 11, 2014Modified: May 6, 2026

4.0

Vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability: 8.0 / Impact: 2.9

Source: NVD

Description

mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality.

Affected (52)

Products: Plone: Plone

Plone

1 product

Plone

Configuration A

44 vulnerable

Vulnerable Software	Affected Versions
Plone Plone	Version 2.1.1
Plone Plone	Version 2.1.2
Plone Plone	Version 2.1.3
Plone Plone	Version 2.1.4
Plone Plone	Version 2.1
Plone Plone	Version 2.5.1
Plone Plone	Version 2.5.2
Plone Plone	Version 2.5.3
Plone Plone	Version 2.5.4
Plone Plone	Version 2.5.5
Plone Plone	Version 2.5
Plone Plone	Version 3.0.1
Plone Plone	Version 3.0.2
Plone Plone	Version 3.0.3
Plone Plone	Version 3.0.4
Plone Plone	Version 3.0.5
Plone Plone	Version 3.0.6
Plone Plone	Version 3.0
Plone Plone	Version 3.1.1
Plone Plone	Version 3.1.2
Plone Plone	Version 3.1.3
Plone Plone	Version 3.1.4
Plone Plone	Version 3.1.5.1
Plone Plone	Version 3.1.6
Plone Plone	Version 3.1.7
Plone Plone	Version 3.1
Plone Plone	Version 3.2.1
Plone Plone	Version 3.2.2
Plone Plone	Version 3.2.3
Plone Plone	Version 3.2
Plone Plone	Version 3.3.1
Plone Plone	Version 3.3.2
Plone Plone	Version 3.3.3
Plone Plone	Version 3.3.4
Plone Plone	Version 3.3.5
Plone Plone	Version 3.3
Plone Plone	Version 4.0.1
Plone Plone	Version 4.0.2
Plone Plone	Version 4.0.3
Plone Plone	Version 4.0.4
Plone Plone	Version 4.0.5
Plone Plone	Version 4.0.6.1
Plone Plone	Version 4.0
Plone Plone	Version 4.1