CVE-2013-7060: Plone - FactoryTool.py Information Disclosure
Summary
CVE-2013-7060: Products/CMFPlone/FactoryTool.py in Plone 3.3 through 4.3.2 allows remote attackers to obtain the installation path via vectors related to a file object for unspecified documentation which is initialized in class scope. Affects plone versions >= 3.3, < 4.3.3. Fixed in 4.3.3. How to fix ↓
Also tracked for
- products-cmfplone · PyPI
The same CVE-2013-7060 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system (CMS) built on top of the Zope application server. It provides an intuitive interface for managing websites and supports various features such as content creation, collaboration, and workflow management. FactoryTool.py is a module in Plone that is responsible for initializing and managing file objects. It is used to handle file-related operations within the CMS.
Vulnerability Detail
The vulnerability (CVE-2013-7060) exists in versions 3.3 through 4.3.2 of Plone. It allows remote attackers to obtain the installation path of the CMS. The issue arises due to the initialization of an unspecified documentation file object in class scope. By exploiting this vulnerability, an attacker can gain knowledge of the installation path, which may aid in further attacks or unauthorized access to sensitive information.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.3.3
This is the first release that contains the fix.
pip install --upgrade "plone==4.3.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability (CVE-2013-7060) in Plone's FactoryTool.py module allows remote attackers to obtain the installation path of the CMS. Users are advised to upgrade to Plone version 4.3.3 or later to mitigate this issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system (CMS) built on top of the Zope application server. It provides a user-friendly interface for managing websites and offers various features for content creation, collaboration, and workflow management.
FactoryTool.py is a module in Plone that is responsible for initializing and managing file objects. It is used for handling file-related operations within the CMS.
The vulnerability allows remote attackers to obtain the installation path of the Plone CMS. This information can be used to aid in further attacks or unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to upgrade to Plone version 4.3.3 or later. This version includes a fix for the vulnerability in the FactoryTool.py module.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
