CVE-2015-7315 Plone unauthorized member addition vulnerability
Attackers can add new members to Plone sites with registration enabled without administrator approval, potentially gaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-7315?
CVE-2015-7315 is a medium-severity missing authorization vulnerability in Plone Plone, published on 25 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.
Weakness: CWE-284
Which versions are affected by CVE-2015-7315?
18 open source packages ship an affected version, including plone, Plone and Products.CMFPlone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
plone PyPI | All versions | None |
plone PyPI | From 3.3 | 4.0a1, 4.1a1, 4.2a1, 4.3a1, 4.3.7, 5.0rc2 |
plone PyPI | From 3.3 to 3.3.6 | None |
plone PyPI | From 4.0a1 to 4.0.10 | None |
plone PyPI | From 4.1a1 to 4.1.6 | None |
plone PyPI | From 4.2a1 to 4.2.7 | None |
12 more packages
plone PyPI | From 4.3a1 to 4.3.6 | None |
Plone PyPI | All versions | None |
Plone PyPI | From 3.3 to 3.3.6 | None |
Plone PyPI | From 4.0a1 to 4.0.10 | None |
Plone PyPI | From 4.1a1 to 4.1.6 | None |
Plone PyPI | From 4.2a1 to 4.2.7 | None |
Plone PyPI | From 4.3a1 to 4.3.6 | None |
Products.CMFPlone PyPI | From 3.3.0 | 4.3.7 |
Products.CMFPlone PyPI | From 5.0a1 | 5.0rc2 |
products-cmfplone PyPI | From 3.3.0 | 4.3.7, 5.0rc2 |
products-cmfplone PyPI | From 3.3.0 | 4.3.7 |
products-cmfplone PyPI | From 5.0a1 | 5.0rc2 |
Products include Plone Plone.
How do I fix CVE-2015-7315?
Upgrade plone to a fixed version for your release line: 4.0a1, 4.1a1, 4.2a1 or 4.3a1.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2015-7315 being exploited?
There is no known exploitation of CVE-2015-7315 in the wild and no public exploit code.
Other vulnerabilities in Plone Plone
Sources
Also known as GHSA-984m-rj28-8c6x, PYSEC-2017-52, PYSEC-2026-2964.