GHSA-5hch-v5pq-x4qp

Plone allows anonymous users to reset any users password through the web via Password Reset Tool

Source: GitHub Advisory Database (reviewed) High CVE-2006-4247

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	Plone	>= 2.5, < 2.5.1	2.5.1

Details

As written in the advisory (Markdown source, shown as plain text).

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2006-4247 advisory
https://github.com/plone/Plone package
https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-5.yaml web
https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-9.yaml web
http://plone.org/about/security/advisories/cve-2006-4247 web