CVE-2013-4189: Multiple unspecified vulnerabilities in (1) dataitems.py, (2) get.py, and (3) traverseName.py in Plone 2.1...

Security readout for executives and security teams

This is a legacy Plone access-control issue. A user who already has administrator rights over one site subtree may be able to reach content above that boundary. It is not described as unauthenticated or internet-wide compromise, but it can break delegated administration boundaries. Exposure is likely limited to organizations still running old Plone versions in the affected ranges, especially deployments using delegated subtree administration. Current exposure cannot be confirmed from the provided sources. Treat as a targeted access-boundary risk in legacy Plone. It is not proven actively exploited here, but affected systems with delegated administrators should be patched or upgraded because content separation may be unreliable. Mitigation focus: Apply the vendor Plone 20130618 Hotfix where applicable.; Check Plone advisory guidance for fixed or supported upgrade paths.; Reduce delegated subtree administrator rights where they are not required..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.