TI-2006-04102 Aliases CVE-2006-4247 GHSA-5hch-v5pq-x4qp

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1…

LOW 30Published 2006-09-29 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Partial · Partial · None
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.

Summary

Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate allows attackers to reset the passwords of other users, related to "an erroneous security declaration."

Why it matters now

EPSS 0.01032 63rd percentileScored 2026-11-07

Fix Fixed Plone (PyPI): 2.5.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	Plone (PyPI)	2.5 to before 2.5.1	2.5.1	Patch available	GHSA-5hch-v5pq-x4qp

— Vendor— Affected all versions Fixed in — No fix listed CNA
Plone (PyPI) Vendor— Affected 2.5 to before 2.5.1 Fixed in 2.5.1 Patch available GHSA-5hch-v5pq-x4qp

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:plone:plone:2.5:::::::*	2.5	Vulnerable	plone
cpe:2.3:a:plone:plone:2.5.1_rc:::::::*	2.5.1_rc	Vulnerable	plone

cpe:2.3:a:plone:plone:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·plone
cpe:2.3:a:plone:plone:2.5.1_rc:*:*:*:*:*:*:* Versions 2.5.1_rc Vulnerable ·plone

Remediation

Fix · GHSA-5hch-v5pq-x4qp Plone (PyPI) Fixed in 2.5.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2006-4247
2026-10-03 Alias added: GHSA-5hch-v5pq-x4qp

References

Patch 1

http://plone.org/about/security/advisories/cve-2006-4247

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2006-4247

Other 3

TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
TI-2021-13226 An issue in Plone CMS v. CVSS 3.1HIGH 8.8
TI-2024-15757 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13… CVSS 3.1HIGH 7.5
TI-2021-12911 Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted… CVSS 3.1CRITICAL 9.9
TI-2020-17872 The official plone Docker images before version of 4.3.18-alpine (Alpine specific)… CVSS 3.1CRITICAL 9.8
TI-2020-06422 A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows… CVSS 3.1CRITICAL 9.8

See all 102 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences