CVE-2015-7315: Medium severity plone cms vulnerability

Q: What is the severity of CVE-2015-7315?

CVE-2015-7315 is classified as a medium severity vulnerability.

Q: How do I fix CVE-2015-7315?

To fix CVE-2015-7315, update to Plone version 4.3.7 or 5.0rc2.

Q: What systems are affected by CVE-2015-7315?

CVE-2015-7315 affects Plone versions 3.x, 4.1.x, 4.2.x, and below 4.3.7 and 5.0rc1.

Q: What can happen if I don't address CVE-2015-7315?

If not addressed, CVE-2015-7315 allows remote attackers to add unauthorized users to a Plone site.

Q: Is there an exploit available for CVE-2015-7315?

While specific exploit code is not publicly disclosed, the vulnerability allows for unauthorized access due to its nature.

Published Sep 21, 2015

Updated

A vulnerability that allows remote attackers to add a new member to a Plone site when registration is enabled, without acknowledgment of site administrator was found. Versions affected are Plone 3.x, 4.1.x, 4.2.x, <4.3.7, <5.0rc1.

Upstream patch:

https://github.com/zopefoundation/Products.CMFCore/commit/e1d981bfa14b664317285f0f36498f4be4a23406

CVE request:

http://seclists.org/oss-sec/2015/q3/586

Other sources

Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.

— MITRE

Affected Software

47 affected componentsFixes available

pip/Plone=5.0rc1

pip/Plone>=4.3a1<=4.3.6

pip/Plone>=4.2a1<=4.2.7

pip/Plone>=4.0a1<=4.0.10

pip/Plone>=3.3<=3.3.6

pip/Products.CMFPlone>=5.0a1<5.0rc2

5.0rc2

pip/Products.CMFPlone>=3.3.0<4.3.6

4.3.7

Plone plone=3.3

Plone plone=3.3.1

Plone plone=3.3.2

Plone plone=3.3.3

Plone plone=3.3.4

Plone plone=3.3.5

Plone plone=3.3.6

Plone plone=4.0

Plone plone=4.0.1

Plone plone=4.0.2

Plone plone=4.0.3

Plone plone=4.0.4

Plone plone=4.0.5

Plone plone=4.0.7

Plone plone=4.0.8

Plone plone=4.0.9

Plone plone=4.0.10

Plone plone=4.1

Plone plone=4.1.1

Plone plone=4.1.2

Plone plone=4.1.3

Plone plone=4.1.4

Plone plone=4.1.5

Plone plone=4.1.6

Plone plone=4.2

Plone plone=4.2.1

Plone plone=4.2.2

Plone plone=4.2.3

Plone plone=4.2.4

Plone plone=4.2.5

Plone plone=4.2.6

Plone plone=4.2.7

Plone plone=4.3

Plone plone=4.3.1

Plone plone=4.3.2

Plone plone=4.3.3

Plone plone=4.3.4

Plone plone=4.3.5

Plone plone=4.3.6

Plone plone=5.0-rc1

Remediation

Event History

Sep 21, 2015

Data Sourced

08:47 AM

DescriptionSeverityAffected Software

Sep 25, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

May 17, 2022

Advisory Published

12:35 AM

Frequently Asked Questions

What is the severity of CVE-2015-7315?

CVE-2015-7315 is classified as a medium severity vulnerability.

How do I fix CVE-2015-7315?

To fix CVE-2015-7315, update to Plone version 4.3.7 or 5.0rc2.

What systems are affected by CVE-2015-7315?

CVE-2015-7315 affects Plone versions 3.x, 4.1.x, 4.2.x, and below 4.3.7 and 5.0rc1.

What can happen if I don't address CVE-2015-7315?

If not addressed, CVE-2015-7315 allows remote attackers to add unauthorized users to a Plone site.

Is there an exploit available for CVE-2015-7315?

While specific exploit code is not publicly disclosed, the vulnerability allows for unauthorized access due to its nature.

CVE-2015-7315: Medium severity plone cms vulnerability

Other sources

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

What is the severity of CVE-2015-7315?

How do I fix CVE-2015-7315?

What systems are affected by CVE-2015-7315?

What can happen if I don't address CVE-2015-7315?

Is there an exploit available for CVE-2015-7315?

Company

Resources

Contact