CVE-2013-4192: Plone Email Spoofing Vulnerability
Summary
CVE-2013-4192: sendto.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to spoof emails via unspecified vectors. Affects plone across 3 version ranges.
>= 2.1, < 4.1.1
>= 4.2, < 4.2.6
>= 4.3, < 4.3.2
Fixed in 4.1.1, 4.2.6 or 4.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications. Plone offers features such as content editing, workflow management, and user authentication. However, versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 of Plone are vulnerable to an email spoofing attack.
Vulnerability Detail
The vulnerability in Plone allows remote authenticated users to spoof emails through unspecified vectors. This means that an attacker with valid credentials can send emails that appear to come from a different sender. By impersonating a trusted source, the attacker may trick recipients into taking malicious actions or disclosing sensitive information. The exact method of exploitation is not disclosed in the vulnerability details.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.1, < 4.1.14.1.1pip install --upgrade "plone==4.1.1" -
>= 4.2, < 4.2.64.2.6pip install --upgrade "plone==4.2.6" -
>= 4.3, < 4.3.24.3.2pip install --upgrade "plone==4.3.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround is provided in the vulnerability details. Users are advised to apply the fix by upgrading to the patched versions of Plone.
Conclusion
The Plone Email Spoofing Vulnerability (CVE-2013-4192) allows authenticated users to send spoofed emails, potentially leading to various malicious activities. Users of Plone should upgrade to the fixed versions (4.1.1, 4.2.6, or 4.3.2) to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications.
Email spoofing is the forgery of an email header to make it appear as if it came from someone or somewhere other than the actual source. In this vulnerability, authenticated users can send emails that appear to come from a different sender.
Email spoofing can be used for various malicious purposes, such as phishing attacks, spreading malware, or tricking recipients into revealing sensitive information.
You can use the Vulert playground at Vulert Scanner to check if your Plone installation is affected by this vulnerability. Simply provide your Pipfile.lock, and Vulert will analyze it for any open-source vulnerabilities.
You can find more information about this vulnerability in the Plone advisory database at https://github.com/pypa/advisory-database/blob/main/vulns/plone/PYSEC-2014-56.yaml
Related vulnerabilities
Recent vulnerabilities recorded for plone.
