CVE-2013-4189: Plone Privilege Escalation
Summary
CVE-2013-4189: Plone Privilege escalation due improper authorization. Affects plone across 3 version ranges.
>= 2.1, <= 4.1
>= 4.2, < 4.2.6
>= 4.3, < 4.3.2
Fixed in 4.2.6 or 4.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites. Plone allows users to create, edit, and publish content, and it offers various features such as version control, workflow management, and access control. However, Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 are vulnerable to privilege escalation attacks.
Vulnerability Detail
The vulnerability in Plone allows remote authenticated users with administrator access to a subtree to access nodes above the subtree through unknown vectors. The specific vulnerabilities are present in the dataitems.py, get.py, and traverseName.py files. The exact vectors of exploitation are undisclosed. This vulnerability can lead to unauthorized access to sensitive information and potential compromise of the entire Plone instance.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.64.2.6pip install --upgrade "plone==4.2.6" -
>= 4.3, < 4.3.24.3.2pip install --upgrade "plone==4.3.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is recommended to apply the fix by upgrading to the latest secure version of Plone.
Conclusion
The Plone Privilege Escalation vulnerability (CVE-2013-4189) allows remote authenticated users to access nodes above their authorized subtree, potentially leading to unauthorized access and compromise of the entire Plone instance. To mitigate this vulnerability, it is crucial to upgrade to a fixed version of Plone. Regularly updating the Plone installation with the latest security patches is essential to ensure the security of the content management system.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites.
Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 are affected by this vulnerability.
This vulnerability allows remote authenticated users with administrator access to a subtree to access nodes above the subtree, potentially leading to unauthorized access to sensitive information and compromise of the entire Plone instance.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Plone. For versions 2.1 through 4.1, upgrade to a version beyond 4.1. For versions 4.2.x through 4.2.5, upgrade to version 4.2.6 or later. For versions 4.3.x through 4.3.1, upgrade to version 4.3.2 or later.
No specific workaround is provided for this vulnerability. It is recommended to apply the fix by upgrading to the latest secure version of Plone.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
