GHSA-jjvw-3h9j-p7jf

Suggest an improvement
Source
https://github.com/advisories/GHSA-jjvw-3h9j-p7jf
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-jjvw-3h9j-p7jf/GHSA-jjvw-3h9j-p7jf.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-jjvw-3h9j-p7jf
Aliases
Published
2022-05-17T04:49:44Z
Modified
2024-10-16T03:00:22.463512Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
  • 7.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Plone Improper Access Control Vulnerability
Details

member_portrait.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 allows remote authenticated users to modify or delete portraits of other users via unspecified vectors.

Database specific
{
    "nvd_published_at": "2014-03-11T19:37:00Z",
    "cwe_ids": [
        "CWE-284"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-08-29T18:25:43Z"
}
References

Affected packages

PyPI / plone

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.1
Fixed
4.1.1

Affected versions

3.*

3.2a1
3.2rc1
3.2
3.2.1
3.2.2
3.2.3
3.3b1
3.3rc1
3.3rc2
3.3rc3
3.3rc4
3.3rc5
3.3
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6

4.*

4.0a1
4.0a2
4.0a3
4.0a4
4.0a5
4.0b1
4.0b2
4.0b3
4.0b4
4.0b5
4.0rc1
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.1a1
4.1a2
4.1a3
4.1b1
4.1b2
4.1rc2
4.1rc3
4.1

Database specific

{
    "last_known_affected_version_range": "<= 4.1"
}

PyPI / plone

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.2
Fixed
4.2.6

Affected versions

4.*

4.2
4.2.1
4.2.2
4.2.3
4.2.4
4.2.5

PyPI / plone

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.3
Fixed
4.3.2

Affected versions

4.*

4.3
4.3.1