Description
Plone 2.0.5, 2.1.2, and 2.5-beta1 does not restrict access to the (1) changeMemberPortrait, (2) deletePersonalPortrait, and (3) testCurrentPassword methods, which allows remote attackers to modify portraits.
Remediation
References
Related Vulnerabilities
WordPress Plugin Wonder Video Embed Cross-Site Scripting (1.7)
WordPress Plugin WooCommerce Cross-Site Scripting (2.2.10)
Joomla! Core 3.x.x Security Bypass (3.0.0 - 3.4.4)
WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2017-5492)
WordPress Plugin Advanced Access Manager Multiple Vulnerabilities (6.6.1)