GitHub Advisoryadvisory · PyPI

GHSA-984m-rj28-8c6x Plone unauthorized member addition vulnerability

HIGH Published 2022-05-17 Modified 2024-10-18 Official page ↗
Aliases
CVE-2015-7315
Ecosystem
PyPI
Packages
Products.CMFPlone, Plone
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-284
Reviewed
2023-08-07

Affected packages

• PyPI Products.CMFPlone: >= 3.3.0, < 4.3.7 → fixed in 4.3.7 • PyPI Products.CMFPlone: >= 5.0a1, < 5.0rc2 → fixed in 5.0rc2 • PyPI Plone: >= 3.3, <= 3.3.6 (no fix yet) • PyPI Plone: >= 4.0a1, <= 4.0.10 (no fix yet) • PyPI Plone: >= 4.1a1, <= 4.1.6 (no fix yet) • PyPI Plone: >= 4.2a1, <= 4.2.7 (no fix yet) • PyPI Plone: >= 4.3a1, <= 4.3.6 (no fix yet) • PyPI Plone: 5.0rc1 (no fix yet)

Description

Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.

Related

Alias · CVE (1)

  • CVE-2015-7315 Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References