{"id":"CVE-2015-7315","published":"2017-09-25T17:00:00Z","modified":"2024-08-06T07:43:46Z","title":"Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and…","vendor":null,"product":null,"tier":"tail","description":{"text":"Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0202,"percentile":0.80897,"provenance":"source"},"cwes":[],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1264791","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/zopefoundation/Products.CMFCore/commit/e1d981bfa14b664317285f0f36498f4be4a23406","tags":["x_refsource_CONFIRM"]},{"url":"http://www.openwall.com/lists/oss-security/2015/09/22/13","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://plone.org/security/hotfix/20150910/anonymous-is-able-to-create-plone-members","tags":["x_refsource_CONFIRM"]}],"priority":{"score":16.2,"factors":[{"name":"EPSS percentile","points":16.18}]},"affected":[{"ecosystem":"PyPI","package":"Products.CMFPlone","vulnerableRanges":[">=3.3.0, <4.3.7",">=5.0a1, <5.0rc2"],"patched":["4.3.7","5.0rc2"],"from":["GHSA-984m-rj28-8c6x","PYSEC-2026-2964"],"provenance":"source"},{"ecosystem":"PyPI","package":"Plone","vulnerableRanges":[">=3.3, <=3.3.6",">=4.0a1, <=4.0.10",">=4.1a1, <=4.1.6",">=4.2a1, <=4.2.7",">=4.3a1, <=4.3.6",">=3.3, <4.0a1",">=4.0, <4.1a1",">=4.1, <4.2a1",">=4.2, <4.3a1",">=4.3, <4.3.7"],"patched":["4.0a1","4.1a1","4.2a1","4.3a1","4.3.7","5.0rc2"],"from":["GHSA-984m-rj28-8c6x","PYSEC-2017-52"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0085","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-products-cmfplone-cve-2015-7315","parents":[{"from":"CVE-2015-7316","to":"CVE-2015-7315","relation":"successor","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Plone","fromFixed":"4.0.11","toFixed":"4.1a1","daysApart":0},{"kind":"same-code","provenance":"machine","files":["Products/CMFPlone/URLTool.py"],"commits":["https://github.com/plone/Products.CMFPlone/commit/1845b0a92312291811b68907bf2aa0fb448c4016","https://github.com/plone/Products.CMFPlone/commit/3da710a2cd68587f0bf34f2e7ea1167d6eeee087"],"basis":"shared function","functions":["isURLInPortal"]},{"kind":"similar","provenance":"machine","score":0.34,"basis":"same package + description similarity"}]}],"children":[{"from":"CVE-2015-7315","to":"CVE-2017-1000481","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Products.CMFPlone","fromFixed":"4.3.7","toFixed":"4.3.17","daysApart":100},{"kind":"same-code","provenance":"machine","files":["Products/CMFPlone/URLTool.py"],"commits":["https://github.com/plone/Products.CMFPlone/commit/1845b0a92312291811b68907bf2aa0fb448c4016","https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab","https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b"],"basis":"shared function","functions":["isURLInPortal"]}]},{"from":"CVE-2015-7315","to":"CVE-2017-1000482","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:Products.CMFPlone","fromFixed":"4.3.7","toFixed":"4.3.17","daysApart":100},{"kind":"same-code","provenance":"machine","files":["Products/CMFPlone/URLTool.py"],"commits":["https://github.com/plone/Products.CMFPlone/commit/1845b0a92312291811b68907bf2aa0fb448c4016","https://github.com/plone/Products.CMFPlone/commit/05a943ecbcdda56bacc93b55c9e2e908d8a7dfab","https://github.com/plone/Products.CMFPlone/commit/0e50e1e67ea3b6d3187f78cb1a1628081f654d3b"],"basis":"shared function","functions":["isURLInPortal"]}]}],"packageHistory":[{"cve":"CVE-2013-7060","published":"2014-05-02","fixed":"4.3.3","kev":false},{"cve":"CVE-2013-7061","published":"2014-05-02","fixed":"4.3.3","kev":false},{"cve":"CVE-2013-7062","published":"2020-01-02","fixed":"4.3.3","kev":false},{"cve":"CVE-2015-7315","published":"2017-09-25","fixed":"4.3.7","kev":false},{"cve":"CVE-2015-7316","published":"2017-09-25","fixed":"5.0rc2","kev":false},{"cve":"CVE-2015-7293","published":"2017-09-25","fixed":"5.0a1","kev":false},{"cve":"CVE-2016-7135","published":"2017-03-07","fixed":"5.0.7","kev":false}],"package":"PyPI:Plone"}}