CVE-2013-4198

Plone's authenticated users able to alter their password despite of policy definition

4.0 MediumFix available

mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality.

Exploit likelihood

1.12%Unchanged since Feb 4, 2022

What each source reports

NVD Score used 4.0

Record: CVE-2013-4198
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness: CWE-264
Updated: 2026-11-02

CVE List No score

Record: CVE-2013-4198
Updated: 2026-11-02

EUVDEUVD-2014-0080 No score

Record: EUVD-2014-0080
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qjxf-6pr8-j87v 5.3

Plone's authenticated users able to alter their password despite of policy definition

mail_password.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality.

Record: GHSA-qjxf-6pr8-j87v
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSVGHSA-qjxf-6pr8-j87v 5.3

Plone's authenticated users able to alter their password despite of policy definition

Record: GHSA-qjxf-6pr8-j87v
CVSS 4.0: 5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-863
Updated: 2026-11-02

OSVPYSEC-2014-62 No score

Record: PYSEC-2014-62
Updated: 2026-11-02

Affected products

plone

Affected packages

Affected packages
Package	Affected	Fixed
`plone` PyPI	2.1 to 4.1	None known
`plone` PyPI	4.2 up to 4.2.6	4.2.6
`plone` PyPI	4.3 up to 4.3.2	4.3.2
`plone` PyPI	2.1 to 4.1, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 43 moreShow less 3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.1a14.1a24.1a34.1b14.1b24.1rc24.1rc3	None known
`plone` PyPI	4.2 up to 4.2.6, plus listed versions 4.2.14.2.24.2.34.2.44.2.5	4.2.6
`plone` PyPI	4.3 up to 4.3.2, plus listed versions 4.3.1	4.3.2
`plone` PyPI	2.1 up to 4.1.1, 4.2 up to 4.2.6, 4.3 up to 4.3.2, plus listed versions 3.23.2.13.2.23.2.33.2a1 Show 45 moreShow less 3.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1a14.1a24.1a34.1b14.1b24.1rc24.1rc34.2.1	4.1.14.2.64.3.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4198 is a medium vulnerability (CVSS 4.0) in Plone, published March 11, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.12%, the 66th percentile. Fixed in plone 4.2.6.

References

This page doesn't list everything

Left out here: 5 versions. The JSON record has them.