GHSA-683w-84m7-p8pw

Suggest an improvement
Source
https://github.com/advisories/GHSA-683w-84m7-p8pw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-683w-84m7-p8pw/GHSA-683w-84m7-p8pw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-683w-84m7-p8pw
Aliases
Published
2022-05-17T04:31:18Z
Modified
2024-10-14T21:33:49.147122Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Plone User account enumeration via crafted URL
Details

membership_tool.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to enumerate user account names via a crafted URL.

Database specific
{
    "nvd_published_at": "2014-09-30T14:55:00Z",
    "severity": "MODERATE",
    "github_reviewed_at": "2023-02-08T17:55:30Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-200"
    ]
}
References

Affected packages

PyPI / plone

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.3

Affected versions

3.*

3.2a1
3.2rc1
3.2
3.2.1
3.2.2
3.2.3
3.3b1
3.3rc1
3.3rc2
3.3rc3
3.3rc4
3.3rc5
3.3
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6

4.*

4.0a1
4.0a2
4.0a3
4.0a4
4.0a5
4.0b1
4.0b2
4.0b3
4.0b4
4.0b5
4.0rc1
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.1a1
4.1a2
4.1a3
4.1b1
4.1b2
4.1rc2
4.1rc3
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.2a1
4.2a2
4.2b1
4.2b2
4.2rc1
4.2rc2
4.2
4.2.1
4.2.2

PyPI / plone

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.3a1
Fixed
4.3b1

Affected versions

4.*

4.3a1
4.3a2