CVE-2006-4247 Plone allows anonymous users to reset any users password through the web via Password Reset Tool
Attackers can reset other users' passwords in Plone's Password Reset Tool due to an erroneous security declaration, leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-4247?
CVE-2006-4247 is a medium-severity authentication bypass vulnerability in Plone Plone, published on 29 Sep 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."
Which versions are affected by CVE-2006-4247?
3 open source packages ship an affected version, including plone and Plone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
plone PyPI | From 2.5 | 2.5.1 |
plone PyPI | From 2.5 | 2.5.1 |
Plone PyPI | From 2.5 | 2.5.1 |
Products include Plone Plone.
How do I fix CVE-2006-4247?
Upgrade plone to 2.5.1 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2006-4247 being exploited?
There is no known exploitation of CVE-2006-4247 in the wild and no public exploit code.
Other vulnerabilities in Plone Plone
Sources
Also known as GHSA-5hch-v5pq-x4qp, PYSEC-2006-5.