TI-2011-01721 Aliases CVE-2011-1950 GHSA-2qx8-589j-gcpx

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the…

LOW 29CWE-264Published 2011-06-06 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: Low
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Partial · Partial
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-264.

Summary

plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011.

Why it matters now

EPSS 0.02349 83rd percentileScored 2026-11-07

Fix Fixed plone.app.users (PyPI): 1.0.5, 1.1.1Plone (PyPI): 4.0.6, 4.1.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	plone.app.users (PyPI)	1.0a1 to before 1.0.5	1.0.5	Patch available	GHSA-2qx8-589j-gcpx
—	plone.app.users (PyPI)	1.1b1 to before 1.1.1	1.1.1	Patch available	GHSA-2qx8-589j-gcpx
—	Plone (PyPI)	4.0.1 to before 4.0.6	4.0.6	Patch available	GHSA-2qx8-589j-gcpx
—	Plone (PyPI)	4.1.0 to before 4.1.1	4.1.1	Patch available	GHSA-2qx8-589j-gcpx

— Vendor— Affected all versions Fixed in — No fix listed CNA
plone.app.users (PyPI) Vendor— Affected 1.0a1 to before 1.0.5 Fixed in 1.0.5 Patch available GHSA-2qx8-589j-gcpx
plone.app.users (PyPI) Vendor— Affected 1.1b1 to before 1.1.1 Fixed in 1.1.1 Patch available GHSA-2qx8-589j-gcpx
Plone (PyPI) Vendor— Affected 4.0.1 to before 4.0.6 Fixed in 4.0.6 Patch available GHSA-2qx8-589j-gcpx
Plone (PyPI) Vendor— Affected 4.1.0 to before 4.1.1 Fixed in 4.1.1 Patch available GHSA-2qx8-589j-gcpx

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:plone:plone:4.0:::::::*	4.0	Vulnerable	plone
cpe:2.3:a:plone:plone:4.1:::::::*	4.1	Vulnerable	plone

cpe:2.3:a:plone:plone:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·plone
cpe:2.3:a:plone:plone:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·plone

Remediation

Fix · GHSA-2qx8-589j-gcpx plone.app.users (PyPI) Fixed in 1.0.5 Advisory →
Fix · GHSA-2qx8-589j-gcpx plone.app.users (PyPI) Fixed in 1.1.1 Advisory →
Fix · GHSA-2qx8-589j-gcpx Plone (PyPI) Fixed in 4.0.6 Advisory →
Fix · GHSA-2qx8-589j-gcpx Plone (PyPI) Fixed in 4.1.1 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2011-1950
2026-10-03 Alias added: GHSA-2qx8-589j-gcpx

References

Patch 1

http://plone.org/products/plone/security/advisories/CVE-2011-1950

Advisory 3

Other 2

TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
TI-2021-13226 An issue in Plone CMS v. CVSS 3.1HIGH 8.8
TI-2024-15757 The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13… CVSS 3.1HIGH 7.5
TI-2021-12911 Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted… CVSS 3.1CRITICAL 9.9
TI-2020-17872 The official plone Docker images before version of 4.3.18-alpine (Alpine specific)… CVSS 3.1CRITICAL 9.8
TI-2020-06422 A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows… CVSS 3.1CRITICAL 9.8

See all 102 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences