{"id":"CVE-2013-4195","aliases":["EUVD-2014-0077","GHSA-j67j-8hrp-76xm","PYSEC-2014-59"],"status":"published","title":"Plone Multiple open redirect vulnerabilities","description":"Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01192,"percentile":0.682,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-601"],"published":"2014-03-11T15:00:00Z","modified":"2026-06-16T23:56:47Z","fixes":[{"ecosystem":"PyPI","package":"plone","fixed_in":["4.1.1","4.2.6","4.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1"},{"last_affected":"4.1"},{"fixed":"4.1.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.6"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3"},{"fixed":"4.3.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1"},{"fixed":"4.1.1"}]}],"versions":["3.2","3.2.1","3.2.2","3.2.3","3.2a1","3.2rc1","3.3","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3b1","3.3rc1","3.3rc2","3.3rc3","3.3rc4","3.3rc5","4.0","4.0.1","4.0.10","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.0a1","4.0a2","4.0a3","4.0a4","4.0a5","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0rc1","4.1","4.1a1","4.1a2","4.1a3","4.1b1","4.1b2","4.1rc2","4.1rc3"]},{"source":"osv","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"fixed":"4.2.6"}]}],"versions":["4.2","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5"]},{"source":"osv","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3"},{"fixed":"4.3.2"}]}],"versions":["4.3","4.3.1"]},{"source":"osv","ecosystem":"PyPI","package":"plone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1"},{"fixed":"4.1.1"},{"introduced":"4.2"},{"fixed":"4.2.6"},{"introduced":"4.3"},{"fixed":"4.3.2"}]}],"versions":["3.2","3.2.1","3.2.2","3.2.3","3.2a1","3.2rc1","3.3","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6","3.3b1","3.3rc1","3.3rc2","3.3rc3","3.3rc4","3.3rc5","4.0","4.0.1","4.0.10","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.0.7","4.0.8","4.0.9","4.0a1","4.0a2","4.0a3","4.0a4","4.0a5","4.0b1","4.0b2","4.0b3","4.0b4","4.0b5","4.0rc1","4.1","4.1a1","4.1a2","4.1a3","4.1b1","4.1b2","4.1rc2","4.1rc3","4.2","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.3","4.3.1"]}],"products":[{"vendor":"plone","product":"plone"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=978471","tags":["x_refsource_CONFIRM","x_transferred","web","report"]},{"url":"http://plone.org/products/plone/security/advisories/20130618-announcement","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","advisory"]},{"url":"http://plone.org/products/plone-hotfix/releases/20130618","tags":["x_refsource_CONFIRM","x_transferred","Patch","web"]},{"url":"http://seclists.org/oss-sec/2013/q3/261","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4195","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-59.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j67j-8hrp-76xm","tags":["advisory"]},{"url":"https://github.com/plone/Plone","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2013-4195","description":"Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2014-03-11T15:00:00Z","modified":"2024-08-06T16:38:01.645Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2014-0077","description":"Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2014-03-11T15:00:00Z","modified":"2024-08-06T16:38:01Z","updated_at":"2026-11-03T01:56:32.187151Z"}],"ghsa":[{"id":"GHSA-j67j-8hrp-76xm","title":"Plone Multiple open redirect vulnerabilities","description":"Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2022-05-17T04:49:44Z","modified":"2024-10-18T21:57:27Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low"},{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:38:11.479492Z"}],"nvd":[{"id":"CVE-2013-4195","description":"Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2014-03-11T19:37:02.817Z","modified":"2026-06-16T23:56:47.613Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:50.049023Z"}],"osv":[{"id":"GHSA-j67j-8hrp-76xm","title":"Plone Multiple open redirect vulnerabilities","description":"Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2022-05-17T04:49:44Z","modified":"2024-10-18T22:01:31.268616Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N","level":"low"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"PYSEC-2014-59","description":"Multiple open redirect vulnerabilities in (1) marmoset_patch.py, (2) publish.py, and (3) principiaredirect.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.","status":"published","published":"2014-03-11T19:37:00Z","modified":"2026-06-10T17:01:32.589604724Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}