Lucene search

PRIOn knowledge basePRION:CVE-2015-7315

HistorySep 25, 2017 - 5:29 p.m.

Code injection

2017-09-2517:29:00

PRIOn knowledge base

www.prio-n.com

7.1 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

69.8%

JSON

Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.

CPENameOperatorVersion
ploneeq3.3
ploneeq4.3.3
ploneeq4.0.5
ploneeq4.3.6
ploneeq4.2.3
ploneeq4.0.2
ploneeq3.3.5
ploneeq4.3.5
ploneeq4.3
ploneeq4.2.2

Name	Operator	Version
plone	eq	3.3
plone	eq	4.3.3
plone	eq	4.0.5
plone	eq	4.3.6
plone	eq	4.2.3
plone	eq	4.0.2
plone	eq	3.3.5
plone	eq	4.3.5
plone	eq	4.3
plone	eq	4.2.2

Rows per page:

1-10 of 401

References

www.openwall.com/lists/oss-security/2015/09/22/13

bugzilla.redhat.com/show_bug.cgi?id=1264791

github.com/zopefoundation/Products.CMFCore/commit/e1d981bfa14b664317285f0f36498f4be4a23406

plone.org/security/hotfix/20150910/anonymous-is-able-to-create-plone-members