GitHub Advisoryadvisory · PyPI
GHSA-5hch-v5pq-x4qp Plone allows anonymous users to reset any users password through the web via Password Reset Tool
HIGH
Official page ↗
- Aliases
- CVE-2006-4247
- Ecosystem
- PyPI
- Packages
- Plone
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Reviewed
- 2024-05-09
Affected packages
• PyPI Plone: >= 2.5, < 2.5.1 → fixed in 2.5.1
Description
Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."
Related
Alias · CVE (1)
- CVE-2006-4247 Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2006-4247 advisory
- https://github.com/plone/Plone package
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-5.yaml web
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-9.yaml web
- http://plone.org/about/security/advisories/cve-2006-4247 web