CVE-2013-4188: Plone - Denial of Service Vulnerability

plone Updated 02 Oct 2025

Summary

11/03/2014

Disclosed on

CVE-2013-4188

CVE

Yes i

Fix available

Moderate

Severity

4.4

CVSS Score

CVE-2013-4188: traverser.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote attackers with administrator privileges to cause a denial of service (infinite loop and resource consumption) via unspecif... Affects plone across 3 version ranges.

>= 2.1, < 4.1.1 >= 4.2, < 4.2.6 >= 4.3, < 4.3.2

Fixed in 4.1.1, 4.2.6 or 4.3.2, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and web applications. Plone is widely used for its robustness, extensibility, and security features. However, a vulnerability has been discovered in versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 of Plone that allows remote attackers with administrator privileges to cause a denial of service (DoS) by triggering an infinite loop and excessive resource consumption. This vulnerability can lead to degraded performance and unavailability of the affected Plone instance.

Vulnerability Detail

The vulnerability, identified as CVE-2013-4188, resides in the 'traverser.py' module of Plone. Attackers with administrator privileges can exploit this vulnerability by manipulating certain resources, resulting in an infinite loop and excessive resource consumption. The specific vectors through which this can be achieved are not disclosed in the available information. However, it is important to note that this vulnerability requires administrative access to the Plone instance. The impact of this vulnerability includes a significant degradation in performance, increased resource utilization, and potential unavailability of the affected Plone instance.

How To Fix

Latest published version: 6.2.2 as of 23 Oct 2026

pip install --upgrade "plone==6.2.2"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 2.1, < 4.1.1 4.1.1
```
pip install --upgrade "plone==4.1.1"
```
>= 4.2, < 4.2.6 4.2.6
```
pip install --upgrade "plone==4.2.6"
```
>= 4.3, < 4.3.2 4.3.2
```
pip install --upgrade "plone==4.3.2"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

No specific workaround has been provided for this vulnerability. However, administrators can consider implementing additional access controls and monitoring mechanisms to detect and mitigate any potential exploitation attempts.

Conclusion

The Plone content management system is vulnerable to a denial of service (DoS) attack due to an infinite loop and excessive resource consumption. This vulnerability can be exploited by attackers with administrator privileges, leading to degraded performance and potential unavailability of the affected Plone instance. To mitigate this risk, it is crucial to upgrade to a patched version of Plone (4.1.1, 4.2.6, or 4.3.2) and review administrator access privileges. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for plone →

FAQ

What is the impact of this vulnerability?

The vulnerability allows attackers with administrator privileges to cause a denial of service (DoS) by triggering an infinite loop and excessive resource consumption. This can lead to degraded performance and unavailability of the affected Plone instance.

How can I determine if my Plone installation is affected?

You can use the Vulert Playground at Vulert Scanner to check if your Plone installation is affected by this vulnerability. Simply provide your Pipfile.lock and the playground will analyze it for any open-source vulnerabilities, including this one.

Are there any known exploits for this vulnerability?

No known exploits have been disclosed for this vulnerability at the time of this report. However, it is important to promptly apply the recommended fixes to mitigate the risk.

Can this vulnerability be exploited remotely?

Yes, this vulnerability can be exploited remotely, but it requires administrative privileges. Attackers with such privileges can manipulate certain resources to trigger the DoS condition.