~ / search / GHSA-qjxf-6pr8-j87v

GHSA-qjxf-6pr8-j87v

Plone's authenticated users able to alter their password despite of policy definition

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-4198

Packages

EcosystemPackageAffectedFixed in
PyPI Plone >= 2.1, <= 4.1 no fix listed
PyPI Plone >= 4.2, < 4.2.6 4.2.6
PyPI Plone >= 4.3, < 4.3.2 4.3.2

Details

As written in the advisory (Markdown source, shown as plain text).

`mail_password.py` in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to bypass the prohibition on password changes via the forgotten password email functionality.

References

External links from the advisory. They lead to third-party sites.