CVE-2015-7315: products-cmfplone Unauthorized Member Addition Vulnerability
Summary
CVE-2015-7315: Plone unauthorized member addition vulnerability. Affects products-cmfplone across 2 version ranges.
>= 3.3.0, < 4.3.7
>= 5.0a1, < 5.0rc2
Fixed in 4.3.7 or 5.0rc2, depending on the release line you run. How to fix ↓
Also tracked for
- plone · PyPI
The same CVE-2015-7315 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Products-CMFPlone is a package used in Plone, a powerful content management system built on Python. It facilitates the management of content and users within Plone sites. This package is essential for enabling user registration and management features. However, certain versions of this package are vulnerable to unauthorized member additions, which can compromise site security.
Vulnerability Detail
The vulnerability allows remote attackers to add new members to a Plone site where registration is enabled, without the site administrator's acknowledgment. This flaw exists in versions 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1. The lack of proper validation in the registration process poses a significant risk, as it can lead to unauthorized access and potential exploitation of the site.
How To Fix
Latest published version: 6.2.2 as of 22 Oct 2026
pip install --upgrade "products-cmfplone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.3.0, < 4.3.74.3.7pip install --upgrade "products-cmfplone==4.3.7" -
>= 5.0a1, < 5.0rc25.0rc2pip install --upgrade "products-cmfplone==5.0rc2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable user registration on your Plone site until the package is updated. This can be done by navigating to the site settings and disabling the registration feature.
Conclusion
The CVE-2015-7315 vulnerability in the products-cmfplone package poses a significant risk by allowing unauthorized member additions to Plone sites. It is crucial to update to the patched versions to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for products-cmfplone →
FAQ
CVE-2015-7315 is a vulnerability in the products-cmfplone package that allows unauthorized addition of members to a Plone site.
Affected versions include 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of risk.
If you cannot update the package right away, consider disabling user registration as a temporary measure to prevent unauthorized access.
References
Related vulnerabilities
Recent vulnerabilities recorded for products-cmfplone.
