CVE-2013-4199: Denial of Service Vulnerability in Plone
Summary
CVE-2013-4199: (1) cb_decode.py and (2) linkintegrity.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote authenticated users to cause a denial of service (resource consumption) via a large zip archiv... Affects plone across 3 version ranges.
>= 2.1, < 4.1.1
>= 4.2, < 4.2.6
>= 4.3, < 4.3.2
Fixed in 4.1.1, 4.2.6 or 4.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Plone is widely used in both small and large organizations for building robust and secure web applications. However, versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 of Plone are vulnerable to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability (CVE-2013-4199) in Plone arises from two Python scripts: cb_decode.py and linkintegrity.py. Remote authenticated users can exploit this vulnerability by sending a large zip archive to the Plone server. When the zip archive is expanded, it consumes excessive system resources, leading to a DoS condition. This vulnerability can be exploited by attackers with valid credentials, allowing them to disrupt the availability of the Plone application. The impact of this vulnerability includes potential service interruptions and resource exhaustion on the affected Plone instances.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.1, < 4.1.14.1.1pip install --upgrade "plone==4.1.1" -
>= 4.2, < 4.2.64.2.6pip install --upgrade "plone==4.2.6" -
>= 4.3, < 4.3.24.3.2pip install --upgrade "plone==4.3.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to the fixed versions as soon as possible.
Conclusion
The vulnerability (CVE-2013-4199) in Plone allows remote authenticated users to cause a denial of service (DoS) by sending a large zip archive to the server. To mitigate this vulnerability, it is crucial to upgrade to the fixed versions or apply the official patches provided by the Plone community. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
The vulnerability allows remote authenticated users to cause a denial of service (DoS) by sending a large zip archive to the Plone server, leading to resource consumption and potential service interruptions.
Remote authenticated users with valid credentials can exploit this vulnerability.
There are no known mitigations for this vulnerability. It is recommended to apply the official patches or upgrade to the fixed versions.
Versions 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 of Plone are affected by this vulnerability.
More information about this vulnerability can be found in the Plone advisory PYSEC-2014-63: https://github.com/pypa/advisory-database/blob/main/vulns/plone/PYSEC-2014-63.yaml
Related vulnerabilities
Recent vulnerabilities recorded for plone.
