GHSA-jcwh-rj6j-vm75

Plone allows remote users to modify arbitrary portraits

Source: GitHub Advisory Database (reviewed) Moderate CVE-2006-1711

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	plone	< 2.0.6	2.0.6
PyPI	plone	>= 2.1.0, <= 2.1.2	no fix listed
PyPI	plone	2.5-beta1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2006-1711 advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/25781 web
https://github.com/plone/Plone package
https://web.archive.org/web/20060412111111/https://dev.plone.org/plone/ticket/5432 web
https://web.archive.org/web/20060422195724/http://www.securityfocus.com/bid/17484 web
http://www.debian.org/security/2006/dsa-1032 web