Every CVE Search/ Get API key

CVE-2006-1711

Plone allows remote users to modify arbitrary portraits

5.0 MediumPublic exploitFix available

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

Exploit likelihood

4.02%Down 3.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.0

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

Record
CVE-2006-1711
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Updated
2026-11-02
CVE List No score

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

Record
CVE-2006-1711
Updated
2026-11-02
EUVDEUVD-2022-4335 No score

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

Record
EUVD-2022-4335
Updated
2026-11-03
GitHub AdvisoriesGHSA-jcwh-rj6j-vm75 No score

Plone allows remote users to modify arbitrary portraits

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

Record
GHSA-jcwh-rj6j-vm75
Updated
2026-11-02
OSVGHSA-jcwh-rj6j-vm75 No score

Plone allows remote users to modify arbitrary portraits

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

Record
GHSA-jcwh-rj6j-vm75
Updated
2026-11-02
OSVPYSEC-2026-733 No score

Plone allows remote users to modify arbitrary portraits

Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.

Record
PYSEC-2026-733
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
plone
PyPI
 through 2.0.5
2.0.6
plone
PyPI
 2.1.0 to 2.1.2 None known
plone
PyPI
 2.5-beta1 to 2.5-beta1 None known
zope-cmfplone
Debian:3.1
 before 2.0.4-3sarge1, plus listed versions
2.0.4-3
2.0.4-3sarge1
plone
PyPI
 before 2.0.6
2.0.6
plone
PyPI
 Listed versions
2.5-beta1
 None known
plone
PyPI
 before 2.0.6, 2.1.0 and later, plus listed versions
2.5-beta13.23.2.13.2.23.2.3
Show 45 moreShow less
3.2a13.2rc13.33.3.13.3.23.3.33.3.43.3.53.3.63.3b13.3rc13.3rc23.3rc33.3rc43.3rc54.04.0.14.0.104.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.94.0a14.0a24.0a34.0a44.0a54.0b14.0b24.0b34.0b44.0b54.0rc14.14.1.14.1.24.1.34.1.44.1.54.1.64.1a1
2.0.6

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBPlone 2.x - MembershipTool Access Control Bypass2006-04-12

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2006-1711 is a medium vulnerability (CVSS 5.0) in Plone, published April 11, 2006. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.02%, the 90th percentile. Fixed in plone 2.0.6.

References

Show 8 moreShow less
This page doesn't list everything

Left out here: 157 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open