CVE-2013-4200 - CVE House
Back to Database
Status published Medium CVE-2013-4200

The isURLInPortal method in the URLTool class in in_portal.py in...

Vulnerability Description

The isURLInPortal method in the URLTool class in in_portal.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 treats URLs starting with a space as a relative URL, which allows remote attackers to bypass the allow_external_login_sites filtering property, redirect users to arbitrary web sites, and conduct phishing attacks via a space before a URL in the "next" parameter to acl_users/credentials_cookie_auth/require_login.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-4200

Credits & Attribution

No credits recorded in the NVD database.

References

More from plone

View All →
CVE-2025-61668
@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user
High 8.7
CVE-2025-58047
Volto affected by possible DoS by invoking specific URL by anonymous user
High 7.5
CVE-2023-42457
plone.rest vulnerable to Denial of Service when ++api++ is used many times
High 7.5
CVE-2023-41048
plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images
Low 3.7
CVE-2022-24740
Improper Authentication in Volto
Medium 5

Affected Vendor

Affected Software

plone
Vulnerable Versions:
2.1, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 3.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1, 3.1.1, 3.1.2, 3.1.3, 3.1.4, 3.1.5.1, 3.1.6, 3.1.7, 3.2, 3.2.1, 3.2.2, 3.2.3, 3.3, 3.3.1, 3.3.2, 3.3.3, 3.3.4, 3.3.5, 4.0, 4.0.1, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6.1, 4.1, 4.2, 4.2.1, 4.2.2, 4.2.3, 4.2.4, 4.2.5, 4.3, 4.3.1

Timeline

Official Publish: January 21st, 2014
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.