PT-2006-1028 · Plone Foundation · Plone
Publicado
2006-04-11
·
Atualizado
2022-05-01
·
CVE-2006-1711
CVSS v2.0
5.0
Média
| Vetor | AV:N/AC:L/Au:N/C:N/I:P/A:N |
Name of the Vulnerable Software and Affected Versions:
Plone versions 2.0.5, 2.1.2, and 2.5-beta1
Description:
The issue allows remote attackers to modify portraits due to a lack of access restriction to certain methods. Specifically, the methods
changeMemberPortrait, deletePersonalPortrait, and testCurrentPassword are vulnerable. This can lead to a breach of protected information integrity. The exploitation of these vulnerabilities can be done remotely.Recommendations:
For Plone version 2.0.5, restrict access to the
changeMemberPortrait, deletePersonalPortrait, and testCurrentPassword methods.
For Plone version 2.1.2, restrict access to the changeMemberPortrait, deletePersonalPortrait, and testCurrentPassword methods.
For Plone version 2.5-beta1, restrict access to the changeMemberPortrait, deletePersonalPortrait, and testCurrentPassword methods.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Plone