9.1crit
CVE-2006-4247
Plone allows anonymous users to reset any users password through the web via Password Reset Tool
Also known as GHSA-5hch-v5pq-x4qp, PYSEC-2006-5, PYSEC-2006-9
Published 20 y ago · modified 4 mo ago · JSON
CVSS
9.1
v3.1 · GitHub
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 64%
Public exploits
0
none known
Summary
Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."
Exploit prediction (EPSS)
1.03% probability of exploitation in the next 30 days, higher than 64% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | plone | >=2.5, <2.5.1 <=2.5 <=2.5.1_rc | 2.5.1 |
References
- plone.org /about/security/advisories/cve-2006-4247 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2006-4247 · advisory
- github.com /plone/Plone · package
- github.com /pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-5.yaml · web
- github.com /pypa/advisory-database/tree/main/vulns/plone/PYSEC-2006-9.yaml · web
- github.com /advisories/GHSA-5hch-v5pq-x4qp · advisory
Sources
- CVE List: CVE-2006-4247
- GitHub Advisory: GHSA-5hch-v5pq-x4qp
- NVD: CVE-2006-4247
- OSV: PYSEC-2006-9
- OSV: PYSEC-2006-5
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.