CVE-2015-7315: Products.CMFPlone Plone Unauthorized Member Addition Vulnerability Vulnerability
HIGH
Advisory Identifier:
GHSA-984m-rj28-8c6x
Advisory Summary
CVE-2015-7315 is a HIGH (CVSS 5.9) plone unauthorized member addition vulnerability vulnerability (CWE-284: Improper Access Control) affecting Products.CMFPlone libraries in the PyPI ecosystem. The issue involves plone unauthorized member addition vulnerability. Remediation is available by upgrading affected packages to version 4.3.7, 5.0rc2.
CVE-2015-7315 at a Glance
CVE Identifier
CVE-2015-7315
GHSA Identifier
GHSA-984m-rj28-8c6x
Severity
HIGH
CVSS v3.1 Base Score
5.9
CWE Classification
CWE-284: Improper Access Control
Affected Product
Products.CMFPlone
Package Ecosystem
PyPI
Published Date
Last Updated
Security Impact
CVSS: 5.9
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Attack Vector
Network (AV:N)
Attack Complexity
High (AC:H)
Privileges Required
None (PR:N)
User Interaction
None (UI:N)
Scope
Unchanged (S:U)
Confidentiality
None (C:N)
Integrity
High (I:H)
Availability
None (A:N)
How to Fix CVE-2015-7315
To remediate this vulnerability, upgrade all affected Products.CMFPlone dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Products.CMFPlone
fixed: 4.3.7
pip install Products.CMFPlone>=4.3.7
Products.CMFPlone
fixed: 5.0rc2
pip install Products.CMFPlone>=5.0rc2
Plone
fixed: Latest secure release
pip install Plone>=Latest secure release
Plone
fixed: Latest secure release
pip install Plone>=Latest secure release
Plone
fixed: Latest secure release
pip install Plone>=Latest secure release
Plone
fixed: Latest secure release
pip install Plone>=Latest secure release
Plone
fixed: Latest secure release
pip install Plone>=Latest secure release
Plone
fixed: Latest secure release
pip install Plone>=Latest secure release
Verify Direct and Transitive Dependencies
Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show Products.CMFPloneHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2015-7315, inspect your installed packages using pip:
pip show Products.CMFPloneAnalyze the terminal output to locate any version of Products.CMFPlone in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 4.3.7), your application is affected.
Note: The pip show Products.CMFPlone command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-284: Improper Access Control, where the product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. In Products.CMFPlone, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.
CVE-2015-7315 Affected Products.CMFPlone Versions
8 component(s)
Fixed Versions:
4.3.75.0rc2
| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
Products.CMFPlone
|
PyPI |
≥ 3.3.0
< 4.3.7
|
4.3.7
|
|
Products.CMFPlone
|
PyPI |
≥ 5.0a1
< 5.0rc2
|
5.0rc2
|
|
Plone
|
PyPI |
≥ 3.3
≤ 3.3.6
|
|
|
Plone
|
PyPI |
≥ 4.0a1
≤ 4.0.10
|
|
|
Plone
|
PyPI |
≥ 4.1a1
≤ 4.1.6
|
|
|
Plone
|
PyPI |
≥ 4.2a1
≤ 4.2.7
|
|
|
Plone
|
PyPI |
≥ 4.3a1
≤ 4.3.6
|
|
|
Plone
|
PyPI |
5.0rc1
All 1 versions
5.0rc1
|
None specified
|
References
NVD — CVE-2015-7315
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7315
Security Fix Commit
FIX COMMIT
https://github.com/plone/Products.CMFPlone/commit/1845b0a92312291811b68907bf2aa0fb448c4016
Security Fix Commit
FIX COMMIT
https://github.com/plone/Products.CMFPlone/commit/9f0111f85cd14f3f067044b59b93e2856c99d542
Security Fix Commit
FIX COMMIT
https://github.com/zopefoundation/Products.CMFCore/commit/e1d981bfa14b664317285f0f36498f4be4a23406
bugzilla.redhat.com/show_bug.cgi
WEB
https://bugzilla.redhat.com/show_bug.cgi?id=1264791
Products.CMFPlone Source Repository
REPOSITORY
https://github.com/plone/Products.CMFPlone
Products.CMFPlone Source Repository
REPOSITORY
https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-52.yaml
Products.CMFPlone Security Information
SECURITY
https://plone.org/security/hotfix/20150910/anonymous-is-able-to-create-plone-members
pypi.org/project/products.pl...
WEB
https://pypi.org/project/Products.PloneHotfix20150910
Products.CMFPlone Security Information
SECURITY
http://www.openwall.com/lists/oss-security/2015/09/22/13
Frequently Asked Questions
What is CVE-2015-7315?
CVE-2015-7315 is a security vulnerability in Products.CMFPlone involving Plone unauthorized member addition vulnerability under CWE-284: Improper Access Control.
Which Products.CMFPlone versions are affected?
Affected versions include releases prior to 4.3.7, 5.0rc2 across affected packages: Products.CMFPlone, Plone.
What version fixes CVE-2015-7315?
Upgrading to 4.3.7, 5.0rc2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is Products.CMFPlone affected?
Yes, Products.CMFPlone is affected in releases prior to 4.3.7, 5.0rc2. Upgrade your dependency to 4.3.7, 5.0rc2 or later.
Is Plone affected?
Yes, Plone is affected in releases prior to Latest secure release. Upgrade your dependency to Latest secure release or later.
What is the CVSS score of CVE-2015-7315?
CVE-2015-7315 has a CVSS v3.1 base score of 5.9 (HIGH) with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N.
What CWE is associated with CVE-2015-7315?
CVE-2015-7315 is classified under CWE-284: Improper Access Control (The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.).
How can I check PyPI dependencies for CVE-2015-7315?
Run the dependency tree command: 'pip show Products.CMFPlone'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON
OSV v1.5 Schema
Normalized schema output
{
"schema_version" : "1.4.0",
"id" : "GHSA-984m-rj28-8c6x",
"modified" : "2024-10-18T21:43:36Z",
"published" : "2022-05-17T00:35:46Z",
"aliases" : [ "CVE-2015-7315" ],
"summary" : "Plone unauthorized member addition vulnerability",
"details" : "Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "Products.CMFPlone"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.3.0"
}, {
"fixed" : "4.3.7"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "< 4.3.6"
}
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "Products.CMFPlone"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "5.0a1"
}, {
"fixed" : "5.0rc2"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "Plone"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.3"
}, {
"last_affected" : "3.3.6"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "Plone"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.0a1"
}, {
"last_affected" : "4.0.10"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "Plone"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.1a1"
}, {
"last_affected" : "4.1.6"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "Plone"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.2a1"
}, {
"last_affected" : "4.2.7"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "Plone"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "4.3a1"
}, {
"last_affected" : "4.3.6"
} ]
} ]
}, {
"package" : {
"ecosystem" : "PyPI",
"name" : "Plone"
},
"versions" : [ "5.0rc1" ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2015-7315"
}, {
"type" : "WEB",
"url" : "https://github.com/plone/Products.CMFPlone/commit/1845b0a92312291811b68907bf2aa0fb448c4016"
}, {
"type" : "WEB",
"url" : "https://github.com/plone/Products.CMFPlone/commit/9f0111f85cd14f3f067044b59b93e2856c99d542"
}, {
"type" : "WEB",
"url" : "https://github.com/zopefoundation/Products.CMFCore/commit/e1d981bfa14b664317285f0f36498f4be4a23406"
}, {
"type" : "WEB",
"url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1264791"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/plone/Products.CMFPlone"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-52.yaml"
}, {
"type" : "WEB",
"url" : "https://plone.org/security/hotfix/20150910/anonymous-is-able-to-create-plone-members"
}, {
"type" : "WEB",
"url" : "https://pypi.org/project/Products.PloneHotfix20150910"
}, {
"type" : "WEB",
"url" : "http://www.openwall.com/lists/oss-security/2015/09/22/13"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-284" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2023-08-07T19:57:45Z",
"nvd_published_at" : "2017-09-25T17:29:00Z"
}
}