GitHub Advisoryadvisory · PyPI
GHSA-jcwh-rj6j-vm75 Plone allows remote users to modify arbitrary portraits
MEDIUM
Official page ↗
- Aliases
- CVE-2006-1711
- Ecosystem
- PyPI
- Packages
- plone
- Severity
- Moderate
- Reviewed
- 2024-02-12
Affected packages
• PyPI plone: < 2.0.6 → fixed in 2.0.6
• PyPI plone: >= 2.1.0, <= 2.1.2 (no fix yet)
• PyPI plone: 2.5-beta1 (no fix yet)
Description
Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.
Related
Alias · CVE (1)
- CVE-2006-1711 Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3)… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2006-1711 advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/25781 web
- https://github.com/plone/Plone package
- https://web.archive.org/web/20060412111111/https://dev.plone.org/plone/ticket/5432 web
- https://web.archive.org/web/20060422195724/http://www.securityfocus.com/bid/17484 web
- http://www.debian.org/security/2006/dsa-1032 web