Red Hat Bugzilla – Bug 978485
CVE-2013-4200 plone: Forwarding of cookie data (session hijack) in certain browsers (in_portal.py)
Last modified: 2015-08-22 11:59:48 EDT
A security flaw was found in the way Plone, a user friendly and powerful content management system, previously protected user's cookie data in certain situations. A remote attacker could provide a specially-crafted URL that, when visited by a valid Plone user could lead to Plone user's cookie to be forwarded if the victim was using certain browsers (possibility of session hijack).
The CVE identifier of CVE-2013-4200 has been assigned to this issue:
Created plone tracking bugs for this issue:
Affects: epel-5 [bug 991015]
The hotfix is available here: