CVE-2013-4198: Plone - Authenticated Users Able to Alter Password Despite Policy Definition
Summary
CVE-2013-4198: Plone's authenticated users able to alter their password despite of policy definition. Affects plone across 3 version ranges.
>= 2.1, <= 4.1
>= 4.2, < 4.2.6
>= 4.3, < 4.3.2
Fixed in 4.2.6 or 4.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Plone is widely used in both small and large organizations for building secure and scalable web applications.
Vulnerability Detail
The vulnerability identified as CVE-2013-4198 affects Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1. It allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality. This means that despite the password policy defined by the system administrator, authenticated users can alter their passwords using the forgotten password feature, potentially compromising the security of the system.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.2, < 4.2.64.2.6pip install --upgrade "plone==4.2.6" -
>= 4.3, < 4.3.24.3.2pip install --upgrade "plone==4.3.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to follow the recommended fix and upgrade to the fixed versions of Plone.
Conclusion
The vulnerability in Plone allows authenticated users to alter their passwords despite the policy definition, potentially compromising the security of the system. Users of Plone are advised to upgrade to the fixed versions to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management.
The vulnerability allows authenticated users to bypass the password policy and alter their passwords using the forgotten password functionality. This can potentially lead to unauthorized access and compromise the security of the system.
Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 are affected by this vulnerability.
To fix this vulnerability, upgrade to the fixed versions of Plone. For Plone versions 2.1 through 4.1, upgrade to a version beyond 4.1. For Plone versions 4.2.x through 4.2.5, upgrade to version 4.2.6 or later. For Plone versions 4.3.x through 4.3.1, upgrade to version 4.3.2 or later.
There is no specific workaround mentioned for this vulnerability. It is recommended to follow the recommended fix and upgrade to the fixed versions of Plone.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
