What is GHSA-jcwh-rj6j-vm75?

GHSA-jcwh-rj6j-vm75 is a security advisory published by GitHub Security Advisories with Medium severity. Plone allows remote users to modify arbitrary portraits

Which CVE IDs does GHSA-jcwh-rj6j-vm75 cover?

GHSA-jcwh-rj6j-vm75 covers the following CVE IDs: CVE-2006-1711. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-jcwh-rj6j-vm75?

GHSA-jcwh-rj6j-vm75 affects 3 products, including: pip/plone:\u003c= 2.0.5; pip/plone:\u003e= 2.1.0, \u003c= 2.1.2; pip/plone:= 2.5-beta1.

GHSA-jcwh-rj6j-vm75Medium

Plone allows remote users to modify arbitrary portraits

Vendor

GitHub Security Advisories

Published

May 1, 2022

Last Modified

February 12, 2024

🔗 CVE IDs covered (1)

CVE-2006-1711 →

📋 Description

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

🎯 Affected products3

pip/plone:<= 2.0.5
pip/plone:>= 2.1.0, <= 2.1.2
pip/plone:= 2.5-beta1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2006-1711
https://exchange.xforce.ibmcloud.com/vulnerabilities/25781
http://www.debian.org/security/2006/dsa-1032
https://web.archive.org/web/20060412111111/https://dev.plone.org/plone/ticket/5432
https://web.archive.org/web/20060422195724/http://www.securityfocus.com/bid/17484
https://github.com/advisories/GHSA-jcwh-rj6j-vm75