CVE-2013-4191
Plone is vulnerable to Information Exposure when generating zip archives
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
Exploit likelihood
What each source reports
NVD Score used
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
- Record
CVE-2013-4191- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
- Record
CVE-2013-4191- Updated
- 2026-11-02
EUVDEUVD-2014-0073 No score
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
- Record
EUVD-2014-0073- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-grwx-4p5v-9g2g
Plone is vulnerable to Information Exposure when generating zip archives
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
- Record
GHSA-grwx-4p5v-9g2g- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVGHSA-grwx-4p5v-9g2g
Plone is vulnerable to Information Exposure when generating zip archives
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
- Record
GHSA-grwx-4p5v-9g2g- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSVPYSEC-2014-55 No score
zip.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce access restrictions when including content in a zip archive, which allows remote attackers to obtain sensitive information by reading a generated archive.
- Record
PYSEC-2014-55- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plonePyPI |
2.1 to 4.1 | 4.1.1 |
plonePyPI |
4.2 up to 4.2.6 | 4.2.6 |
plonePyPI |
4.3 up to 4.3.2 | 4.3.2 |
plonePyPI |
2.1 up to 4.1.1, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 44 moreShow less3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1a14.1a24.1a34.1b14.1b24.1rc24.1rc3 |
4.1.1 |
plonePyPI |
4.2 up to 4.2.6, plus listed versions 4.2.14.2.24.2.34.2.44.2.5 |
4.2.6 |
plonePyPI |
4.3 up to 4.3.2, plus listed versions 4.3.1 |
4.3.2 |
plonePyPI |
2.1 up to 4.1.1, 4.2 up to 4.2.6, 4.3 up to 4.3.2, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1a14.1a24.1a34.1b14.1b24.1rc24.1rc34.2.1 |
4.1.14.2.64.3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4191 is a medium vulnerability (CVSS 5.8) in Plone, published March 11, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.19%, the 68th percentile. Fixed in plone 4.1.1.
References
plone.org/products/plone/security/advisories/20130618-announcement
seclists.org/oss-sec/2013/q3/261
bugzilla.redhat.com/show_bug.cgi?id=978453
nvd.nist.gov/vuln/detail/CVE-2013-4191
github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-55.yaml
Left out here: 5 versions. The JSON record has them.