CVE-2013-4198: Plone - Bypass Password Change Restriction via Forgotten Password Email
Summary
CVE-2013-4198: mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality. Affects plone across 3 version ranges.
>= 2.1, < 4.1.1
>= 4.2, < 4.2.6
>= 4.3, < 4.3.2
Fixed in 4.1.1, 4.2.6 or 4.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites, intranets, and collaborative workspaces. Plone allows users to create, edit, and publish content, as well as manage user accounts and permissions. However, a vulnerability in Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality.
Vulnerability Detail
The vulnerability in Plone allows authenticated users to change their passwords even if the system is configured to prohibit password changes. This can be exploited by leveraging the forgotten password email functionality. By requesting a password reset, an attacker with a valid account can receive an email containing a link to reset the password. The link can be used to bypass the password change restriction and set a new password, potentially gaining unauthorized access to the account. This vulnerability poses a risk to the confidentiality and integrity of user accounts and the overall security of the Plone installation.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.1, < 4.1.14.1.1pip install --upgrade "plone==4.1.1" -
>= 4.2, < 4.2.64.2.6pip install --upgrade "plone==4.2.6" -
>= 4.3, < 4.3.24.3.2pip install --upgrade "plone==4.3.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. However, administrators can consider disabling the forgotten password email functionality as a temporary measure until the Plone installation can be upgraded to a fixed version. This can be done by modifying the Plone configuration or disabling the corresponding feature in the user interface.
Conclusion
The vulnerability in Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows authenticated users to bypass the prohibition on password changes via the forgotten password email functionality. To mitigate this risk, it is crucial to upgrade to a fixed version of Plone and review the overall security configuration of the installation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites, intranets, and collaborative workspaces.
Plone versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 are affected by this vulnerability.
An attacker with a valid account can exploit this vulnerability by requesting a password reset and using the link provided in the forgotten password email to bypass the password change restriction and set a new password.
This vulnerability allows unauthorized users to change their passwords and potentially gain unauthorized access to user accounts. It can lead to unauthorized disclosure of sensitive information, unauthorized modification of content, and overall compromise of the Plone installation.
To protect your Plone installation, it is recommended to upgrade to a fixed version of Plone (4.1.1, 4.2.6, or 4.3.2). Additionally, review and strengthen the overall security configuration of your Plone installation, including user account policies and access controls.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
