CVE-2013-4197: Plone - Unauthorized Modification or Deletion of User Portraits
Summary
CVE-2013-4197: Plone Improper Access Control Vulnerability. Affects plone across 3 version ranges.
>= 2.1, < 4.1.1
>= 4.2, < 4.2.6
>= 4.3, < 4.3.2
Fixed in 4.1.1, 4.2.6 or 4.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Plone allows users to upload and display profile portraits, which can be modified or deleted by the user who owns the portrait. However, a vulnerability in Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users.
Vulnerability Detail
The vulnerability (CVE-2013-4197) in Plone allows authenticated users to manipulate or remove the profile portraits of other users. The specific vectors through which this can be exploited are unspecified. An attacker with valid credentials can abuse this vulnerability to modify or delete portraits of other users, potentially leading to unauthorized changes to user profiles and impersonation. This can have serious consequences, such as identity theft, reputation damage, or unauthorized access to sensitive information.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.1, < 4.1.14.1.1pip install --upgrade "plone==4.1.1" -
>= 4.2, < 4.2.64.2.6pip install --upgrade "plone==4.2.6" -
>= 4.3, < 4.3.24.3.2pip install --upgrade "plone==4.3.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Users are advised to upgrade to the fixed versions as soon as possible to mitigate the risk.
Conclusion
The vulnerability in Plone allows authenticated users to modify or delete portraits of other users, posing a risk of unauthorized changes to user profiles and impersonation. Users of Plone should upgrade to the fixed versions (4.1.1, 4.2.6, or 4.3.2) to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
The vulnerability allows authenticated users to modify or delete portraits of other users, potentially leading to unauthorized changes to user profiles and impersonation.
An attacker with valid credentials can abuse this vulnerability to manipulate or remove the profile portraits of other users.
There are no known instances of this vulnerability being exploited in the wild.
Yes, the vulnerability was fixed in Plone versions 4.1.1, 4.2.6, and 4.3.2. Users are advised to upgrade to these versions to mitigate the risk.
The consequences of this vulnerability include identity theft, reputation damage, and unauthorized access to sensitive information.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
