id: PYSEC-2014-60
details: The object manager implementation (objectmanager.py) in Plone 2.1 through
  4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly restrict access
  to internal methods, which allows remote attackers to obtain sensitive information
  via a crafted request.
affected:
- package:
    name: plone
    ecosystem: PyPI
    purl: pkg:pypi/plone
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "2.1"
    - fixed: 4.1.1
    - introduced: "4.2"
    - fixed: 4.2.6
    - introduced: "4.3"
    - fixed: 4.3.2
  versions:
  - "3.2"
  - 3.2.1
  - 3.2.2
  - 3.2.3
  - 3.2a1
  - 3.2rc1
  - "3.3"
  - 3.3.1
  - 3.3.2
  - 3.3.3
  - 3.3.4
  - 3.3.5
  - 3.3.6
  - 3.3b1
  - 3.3rc1
  - 3.3rc2
  - 3.3rc3
  - 3.3rc4
  - 3.3rc5
  - "4.0"
  - 4.0.1
  - 4.0.10
  - 4.0.2
  - 4.0.3
  - 4.0.4
  - 4.0.5
  - 4.0.6
  - 4.0.7
  - 4.0.8
  - 4.0.9
  - 4.0a1
  - 4.0a2
  - 4.0a3
  - 4.0a4
  - 4.0a5
  - 4.0b1
  - 4.0b2
  - 4.0b3
  - 4.0b4
  - 4.0b5
  - 4.0rc1
  - "4.1"
  - 4.1a1
  - 4.1a2
  - 4.1a3
  - 4.1b1
  - 4.1b2
  - 4.1rc2
  - 4.1rc3
  - "4.2"
  - 4.2.1
  - 4.2.2
  - 4.2.3
  - 4.2.4
  - 4.2.5
  - "4.3"
  - 4.3.1
references:
- type: WEB
  url: http://plone.org/products/plone-hotfix/releases/20130618
- type: ADVISORY
  url: http://plone.org/products/plone/security/advisories/20130618-announcement
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=978475
- type: WEB
  url: http://seclists.org/oss-sec/2013/q3/261
- type: ADVISORY
  url: https://github.com/advisories/GHSA-qphh-5fv5-2mjj
aliases:
- CVE-2013-4196
- GHSA-qphh-5fv5-2mjj
modified: "2021-07-25T23:34:46.895458Z"
published: "2014-03-11T19:37:00Z"