PyPI/products-cmfplone CVE-2015-7315: medium 5.9, EPSS 2.02%

Plone unauthorized member addition vulnerability

Action: Upgrade products-cmfplone to 4.3.7 or later.

pip install products-cmfplone==4.3.7

pip install products-cmfplone==5.0rc2

Affected

Fixed versions

Sources

• osv: GHSA-984m-rj28-8c6x
• https://nvd.nist.gov/vuln/detail/CVE-2015-7315
• https://github.com/plone/Products.CMFPlone/commit/1845b0a92312291811b68907bf2aa0fb448c4016
• https://github.com/plone/Products.CMFPlone/commit/9f0111f85cd14f3f067044b59b93e2856c99d542
• https://github.com/zopefoundation/Products.CMFCore/commit/e1d981bfa14b664317285f0f36498f4be4a23406
• https://bugzilla.redhat.com/show_bug.cgi?id=1264791
• https://github.com/plone/Products.CMFPlone
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-52.yaml
• https://plone.org/security/hotfix/20150910/anonymous-is-able-to-create-plone-members
• https://pypi.org/project/Products.PloneHotfix20150910
• http://www.openwall.com/lists/oss-security/2015/09/22/13

CVE-2015-7315 · published 2022-05-17T00:35:46Z · modified 2026-07-13T16:43:05.451573089Z · JSON