id: PYSEC-2014-57
details: typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through
  4.3.1 does not properly enforce the immutable setting on unspecified content edit
  forms, which allows remote attackers to hide fields on the forms via a crafted URL.
affected:
- package:
    name: plone
    ecosystem: PyPI
    purl: pkg:pypi/plone
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "2.1"
    - fixed: 4.1.1
    - introduced: "4.2"
    - fixed: 4.2.6
    - introduced: "4.3"
    - fixed: 4.3.2
  versions:
  - "3.2"
  - 3.2.1
  - 3.2.2
  - 3.2.3
  - 3.2a1
  - 3.2rc1
  - "3.3"
  - 3.3.1
  - 3.3.2
  - 3.3.3
  - 3.3.4
  - 3.3.5
  - 3.3.6
  - 3.3b1
  - 3.3rc1
  - 3.3rc2
  - 3.3rc3
  - 3.3rc4
  - 3.3rc5
  - "4.0"
  - 4.0.1
  - 4.0.10
  - 4.0.2
  - 4.0.3
  - 4.0.4
  - 4.0.5
  - 4.0.6
  - 4.0.7
  - 4.0.8
  - 4.0.9
  - 4.0a1
  - 4.0a2
  - 4.0a3
  - 4.0a4
  - 4.0a5
  - 4.0b1
  - 4.0b2
  - 4.0b3
  - 4.0b4
  - 4.0b5
  - 4.0rc1
  - "4.1"
  - 4.1a1
  - 4.1a2
  - 4.1a3
  - 4.1b1
  - 4.1b2
  - 4.1rc2
  - 4.1rc3
  - "4.2"
  - 4.2.1
  - 4.2.2
  - 4.2.3
  - 4.2.4
  - 4.2.5
  - "4.3"
  - 4.3.1
references:
- type: WEB
  url: http://plone.org/products/plone-hotfix/releases/20130618
- type: ADVISORY
  url: http://plone.org/products/plone/security/advisories/20130618-announcement
- type: WEB
  url: http://seclists.org/oss-sec/2013/q3/261
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=978469
- type: ADVISORY
  url: https://github.com/advisories/GHSA-6fgf-x7wg-hp8r
aliases:
- CVE-2013-4193
- GHSA-6fgf-x7wg-hp8r
modified: "2021-07-25T23:34:46.454886Z"
published: "2014-03-11T19:37:00Z"