GHSA-JCWH-RJ6J-VM75 Plone allows remote users to modify arbitrary portraits

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the 1 changeMemberPortrait, 2 deletePersonalPortrait, and 3 testCurrentPassword methods, which allows remote attackers to modify portraits...

Code injection

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the 1 changeMemberPortrait, 2 deletePersonalPortrait, and 3 testCurrentPassword methods, which allows remote attackers to modify portraits...

CVE-2006-1711

CVE-2006-1711 affects Plone 2.0.5, 2.1.2, and 2.5-beta1; the issue is failure to restrict access to changeMemberPortrait, deletePersonalPortrait, and testCurrentPassword, enabling remote modification of portraits. Root cause: inadequate access controls on those methods. Exploitation details are n...