CVE-2013-4197

Plone Improper Access Control Vulnerability

5.5 MediumFix available

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.

Exploit likelihood

1.26%Up 0.1 points since Feb 4, 2022

What each source reports

NVD Score used 5.5

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.

Record: CVE-2013-4197
CVSS 2.0: 5.5 MediumAV:N/AC:L/Au:S/C:N/I:P/A:P
Weakness: CWE-20
Updated: 2026-11-02

CVE List No score

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.

Record: CVE-2013-4197
Updated: 2026-11-02

EUVDEUVD-2014-0079 No score

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.

Record: EUVD-2014-0079
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jjvw-3h9j-p7jf 7.2

Plone Improper Access Control Vulnerability

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.

Record: GHSA-jjvw-3h9j-p7jf
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

OSVGHSA-jjvw-3h9j-p7jf 7.2

Plone Improper Access Control Vulnerability

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.

Record: GHSA-jjvw-3h9j-p7jf
CVSS 4.0: 7.2 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 8.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

OSVPYSEC-2014-61 No score

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.

Record: PYSEC-2014-61
Updated: 2026-11-02

Affected products

plone

Affected packages

Affected packages
Package	Affected	Fixed
`plone` PyPI	2.1 to 4.1	4.1.1
`plone` PyPI	4.2 up to 4.2.6	4.2.6
`plone` PyPI	4.3 up to 4.3.2	4.3.2
`plone` PyPI	2.1 up to 4.1.1, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 44 moreShow less 3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1a14.1a24.1a34.1b14.1b24.1rc24.1rc3	4.1.1
`plone` PyPI	4.2 up to 4.2.6, plus listed versions 4.2.14.2.24.2.34.2.44.2.5	4.2.6
`plone` PyPI	4.3 up to 4.3.2, plus listed versions 4.3.1	4.3.2
`plone` PyPI	2.1 up to 4.1.1, 4.2 up to 4.2.6, 4.3 up to 4.3.2, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less 3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1a14.1a24.1a34.1b14.1b24.1rc24.1rc34.2.1	4.1.14.2.64.3.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4197 is a medium vulnerability (CVSS 5.5) in Plone, published March 11, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.26%, the 69th percentile. Fixed in plone 4.1.1.

References

This page doesn't list everything

Left out here: 5 versions. The JSON record has them.