Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is enabled, allows an attacker to "masquerade as a group."

The version of Plone installed on the remote host is 2.5.x prior to 2.5.2. It is, therefore, affected by the following vulnerabilities:

  - Unspecified vulnerability in the Password Reset Tool before 0.4.1 on Plone 2.5 and 2.5.1 Release Candidate     allows attackers to reset the passwords of other users, related to 'an erroneous security declaration'.
    (CVE-2006-4247)

  - Unspecified vulnerability in PlonePAS allows an attacker to 'masquerade as a group'. (CVE-2006-4249)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1, when anonymous member registration is
    enabled, allows an attacker to "masquerade as a group." (CVE-2006-4249)

Plone.org reports :

PlonePAS-using Plone releases (Plone 2.5 and Plone 2.5.1) has a potential vulnerability that allows a user to masquerade as a group.
Please update your sites.

ID	Name	Product	Family	Type	Severity
329036	Plone 2.5.x < 2.5.2 Multiple Vulnerabilities	Nessus	Misc.	Local	critical
431731	SCA: security update for Plone (GHSA-r7j4-82xw-8m9p)	Tenable Cloud Security	SCA Checks	Local	high
431731	SCA: security update for Plone (GHSA-r7j4-82xw-8m9p)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
23954	FreeBSD : plone -- user can masquerade as a group (f4ff7434-9505-11db-9ddc-0011098b2f36)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2006-4249

high

Tenable Plugins

critical

high

high

medium