Plone allows anonymous users to reset any users password through the web via Password Reset Tool
Moderate severity
GitHub Reviewed
Published
May 1, 2022
to the GitHub Advisory Database
•
Updated Nov 22, 2024
Description
Published by the National Vulnerability Database
Sep 29, 2006
Published to the GitHub Advisory Database
May 1, 2022
Reviewed
May 9, 2024
Last updated
Nov 22, 2024
Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."
References