An information disclosure vulnerability in plone.app.content allows unauthenticated users to list users and groups of a Plone site via the Plone REST API when the 'many users?' and 'many groups?' settings are not enabled. The vulnerability exposes user IDs and full names of users.
| Vendor | Product | Versions |
|---|---|---|
| plone | plone.app.content | plone.app.content < 4.2.1 (Plone 6.0 and 6.1), plone.app.content < 5.0.1 (Plone 6.2) |
Loading…
