Bug 978480 (CVE-2013-4198)

Summary:	CVE-2013-4198 plone: Authenticated users able to alter their password despite of policy definition / setting prohibiting it (mail_password.py)
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	jonathansteffan, security-response-team
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-22 15:59:54 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	991015
Bug Blocks:	973222

Description Jan Lieskovsky 2013-06-26 17:23:59 UTC

A security flaw was found in the way Plone, a user friendly and powerful content management system, restricted access to password change for unauthorized users. If from policy definition Plone user in question was not allowed to change their password, they (previously) could still reset / change the password via forgotten password email functionality.

Comment 1 Jan Lieskovsky 2013-07-31 16:19:54 UTC

References:
  http://plone.org/products/plone/security/advisories/20130611-announcement

Comment 2 Jan Lieskovsky 2013-08-01 09:20:46 UTC

The CVE identifier of CVE-2013-4198 has been assigned to this issue:
  http://www.openwall.com/lists/oss-security/2013/08/01/2

Comment 3 Jan Lieskovsky 2013-08-01 12:13:04 UTC

Created plone tracking bugs for this issue:

Affects: epel-5 [bug 991015]