Description
plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | plone | >= 4.0.1, < 4.0.6 | 4.0.6 | GHSA-2qx8-589j-gcpx |
| PyPI | plone | >= 4.1.0, < 4.1.1 | 4.1.1 | GHSA-2qx8-589j-gcpx |
| PyPI | plone | < 4.1.1 | 4.1.1 | PYSEC-2011-16 |
| PyPI | plone-app-users | >= 1.0a1, < 1.0.5 | 1.0.5 | GHSA-2qx8-589j-gcpx |
| PyPI | plone-app-users | >= 1.1b1, < 1.1.1 | 1.1.1 | GHSA-2qx8-589j-gcpx |
| PyPI | plone-app-users | >= 1.0a1, < 1.0.5 · >= 1.1b1, < 1.1.1 | 1.0.5, 1.1.1 | PYSEC-2026-2888 |
References
- 44775 third-party-advisory
- 48005 vdb-entry
- plone-data-security-bypass(67695) vdb-entry
- 72729 vdb-entry
- 8269 third-party-advisory
- http://plone.org/products/plone/security/advisories/CVE-2011-1950
- 20110526 [CVE-REQUEST] Plone XSS and permission errors mailing-list