GitHub Advisoryadvisory · PyPI

GHSA-2qx8-589j-gcpx Plone and plone.app.users allow remote authenticated users to modify the properties of arbitrary accounts

HIGH Published 2018-07-23 Modified 2024-10-09 Official page ↗
Aliases
CVE-2011-1950
Ecosystem
PyPI
Packages
plone.app.users, Plone
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Reviewed
2020-06-16

Affected packages

• PyPI plone.app.users: >= 1.0a1, < 1.0.5 → fixed in 1.0.5 • PyPI plone.app.users: >= 1.1b1, < 1.1.1 → fixed in 1.1.1 • PyPI Plone: >= 4.0.1, < 4.0.6 → fixed in 4.0.6 • PyPI Plone: >= 4.1.0, < 4.1.1 → fixed in 4.1.1

Description

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011.

Related

Alias · CVE (1)

  • CVE-2011-1950 plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified… vulnerability

References