Executive brief
Plone is an open-source content management system used to build websites and intranets. An authenticated user can modify the properties of arbitrary accounts, potentially escalating privileges or compromising other user accounts. This allows someone with a regular user login to tamper with administrator or other privileged accounts without authorization.
Technical details
The vulnerability exists in plone.app.users, a Plone package that handles user management. An authenticated attacker can modify properties of arbitrary user accounts through unspecified vectors, likely due to insufficient authorization checks. The attack requires valid login credentials but does not require administrative access. An attacker can exploit this to escalate privileges, lock out other users, or hijack high-privilege accounts. Patches are available in plone-app-users 1.0.5+, 1.1.1+, and Plone 4.0.6+ and 4.1.1+.
Affected products
- Plone plone 4.0.1–4.0.5, 4.1.0
- Plone plone.app.users 1.0a1–1.0.4, 1.1b1–1.1
Timeline
- 2011-06: disclosed: Vulnerability exploited in the wild
- 2018-07-23: advisory: GHSA-2qx8-589j-gcpx published
- 2011: patched: Patches released for affected versions