CVE-2006-1711
zope-cmfplone - programming error
EPSS 11.7%
Description
Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.
How to fix CVE-2006-1711
To remediate CVE-2006-1711, upgrade the affected package to a fixed version below.
- Debian/zope-cmfplone—upgrade to 2.0.4-3sarge1 or later
- PyPI/plone—upgrade to 2.0.6 or later
Is CVE-2006-1711 being exploited?
Moderate — EPSS is 11.7%. Track this CVE but it's not at the top of the prioritisation list.
Affected packages (2)
- from 0, < 2.0.4-3sarge1
- from 0, < 2.0.6