CVE-2015-7293: Plone vulnerable to cross-site request forgery
Summary
CVE-2015-7293: Plone vulnerable to cross-site request forgery. Affects plone versions < 5.0a1. Fixed in 5.0a1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications. Plone is widely used in various industries and has a large community of developers and users. However, versions before 5.x are vulnerable to cross-site request forgery (CSRF) attacks.
Vulnerability Detail
The vulnerability in Plone arises from multiple CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier. These vulnerabilities allow an attacker to trick a user into performing unintended actions on their behalf. By exploiting these vulnerabilities, an attacker can perform actions such as changing user settings, deleting content, or executing arbitrary code. This can lead to unauthorized access, data loss, or even a complete compromise of the affected Plone instance.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0a1
This is the first release that contains the fix.
pip install --upgrade "plone==5.0a1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Plone versions before 5.x are vulnerable to cross-site request forgery (CSRF) attacks. To protect your Plone installation, it is crucial to upgrade to the latest version (5.x or later) where these vulnerabilities have been addressed. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system built on top of the Zope application server. It provides a robust and flexible platform for creating and managing websites, intranets, and web applications.
Cross-site request forgery (CSRF) is a type of attack where an attacker tricks a user into performing unintended actions on their behalf. By exploiting CSRF vulnerabilities, an attacker can perform actions such as changing user settings, deleting content, or executing arbitrary code.
This vulnerability affects Plone versions before 5.x. It arises from multiple CSRF vulnerabilities in Zope Management Interface 4.3.7 and earlier. Exploiting these vulnerabilities can lead to unauthorized access, data loss, or even a complete compromise of the affected Plone instance.
To fix this vulnerability, it is recommended to upgrade to Plone version 5.x or later. The Plone development team has addressed these CSRF vulnerabilities in the newer versions, implementing security measures to prevent such attacks.
No specific workaround has been provided for this vulnerability. It is essential to upgrade to the latest version of Plone to mitigate the risk of CSRF attacks.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
