CVE-2015-7293: Cross-Site Request Forgery (CSRF) Vulnerabilities in Zope Management Interface and Plone
Summary
CVE-2015-7293: Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x. Affects plone versions < 5.0a1. Fixed in 5.0a1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zope Management Interface is a web-based administrative interface for managing Zope applications. Plone is a content management system built on top of Zope. Both Zope Management Interface and Plone are widely used in various web applications. This vulnerability affects versions of Zope Management Interface up to 4.3.7 and Plone before 5.x.
Vulnerability Detail
Multiple cross-site request forgery (CSRF) vulnerabilities have been discovered in Zope Management Interface and Plone. These vulnerabilities allow an attacker to trick authenticated users into performing unintended actions on their behalf. By crafting malicious requests and tricking users into clicking on specially crafted links, an attacker can exploit these vulnerabilities to perform actions such as changing user passwords, modifying content, or executing arbitrary code.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.0a1
This is the first release that contains the fix.
pip install --upgrade "plone==5.0a1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or upgrade to a fixed version as soon as possible.
Conclusion
In conclusion, multiple cross-site request forgery (CSRF) vulnerabilities have been discovered in Zope Management Interface and Plone. These vulnerabilities can be exploited by attackers to perform unauthorized actions on behalf of authenticated users. It is crucial to upgrade to a fixed version or apply the official patches as soon as possible to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Cross-site request forgery (CSRF) is an attack that tricks the victim into submitting a malicious request. The attacker crafts a request that appears to be legitimate and tricks the victim into performing unintended actions on their behalf.
An attacker can exploit these vulnerabilities by crafting malicious requests and tricking authenticated users into clicking on specially crafted links. This allows the attacker to perform actions on behalf of the user without their consent.
An attacker can perform various actions depending on the privileges of the targeted user. This includes changing user passwords, modifying content, executing arbitrary code, and potentially gaining unauthorized access to sensitive information.
No, only versions of Zope Management Interface up to 4.3.7 and Plone before 5.x are affected. Versions 4.3.8 and later of Zope Management Interface and version 5.x and later of Plone are not affected.
More information about upgrading and applying patches can be found in the official documentation for Zope Management Interface and Plone. It is recommended to follow the official upgrade instructions provided by the respective projects.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
