CVE-2011-1950
plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011.
- EPSS
- 2.3% chance of exploitation in the next 30 days; higher than 83% of CVEs (scores of 2026-10-31)
- CWE
- CWE-264
- Published
- Modified
- Record from
- the NVD, synced
Affected
- plone:plone
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-2qx8-589j-gcpx | PyPI | plone-app-users | >=1.0a1 <1.0.5 | 1.0.5 |
| GHSA-2qx8-589j-gcpx | PyPI | plone-app-users | >=1.1b1 <1.1.1 | 1.1.1 |
| GHSA-2qx8-589j-gcpx | PyPI | plone | >=4.0.1 <4.0.6 | 4.0.6 |
| GHSA-2qx8-589j-gcpx | PyPI | plone | >=4.1.0 <4.1.1 | 4.1.1 |
| PYSEC-2011-16 | PyPI | plone | <4.1.1 | 4.1.1 |
| PYSEC-2026-2888 | PyPI | plone-app-users | >=1.0a1 <1.0.5 >=1.1b1 <1.1.1 | 1.0.5, 1.1.1 |