CVE-2011-1950

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011.

CVSS v2.0 5.5 MEDIUM

5.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:P

Exploitability : 8.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.securityfocus.com/bid/48005
http://secunia.com/advisories/44775	Vendor Advisory
http://plone.org/products/plone/security/advisories/CVE-2011-1950	Patch Vendor Advisory
http://osvdb.org/72729
http://securityreason.com/securityalert/8269
https://exchange.xforce.ibmcloud.com/vulnerabilities/67695
http://www.securityfocus.com/archive/1/518155/100/0/threaded

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:plone:plone:4.0:::::::*
	cpe:2.3:a:plone:plone:4.1:::::::*

Information

Published : 2011-06-06 12:55

Updated : 2018-10-09 12:32

NVD link : CVE-2011-1950

Mitre link : CVE-2011-1950

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Products Affected

plone

plone

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/48005", "name": "48005", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/44775", "name": "44775", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://plone.org/products/plone/security/advisories/CVE-2011-1950", "name": "http://plone.org/products/plone/security/advisories/CVE-2011-1950", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://osvdb.org/72729", "name": "72729", "tags": [], "refsource": "OSVDB"}, {"url": "http://securityreason.com/securityalert/8269", "name": "8269", "tags": [], "refsource": "SREASON"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/67695", "name": "plone-data-security-bypass(67695)", "tags": [], "refsource": "XF"}, {"url": "http://www.securityfocus.com/archive/1/518155/100/0/threaded", "name": "20110526 [CVE-REQUEST] Plone XSS and permission errors", "tags": [], "refsource": "BUGTRAQ"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2011-1950", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 4.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2011-06-06T19:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-09T19:32Z"}

5.5 /10