CVE-2015-7315: Plone Remote Member Addition Vulnerability
Summary
CVE-2015-7315: Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without ac... Affects plone across 7 version ranges.
>= 3.3, < 4.0a1
>= 4.0, < 4.1a1
>= 4.1, < 4.2a1
>= 4.2, < 4.3a1
>= 4.3, < 4.3.7
>= 5.0a1, < 5.0rc2
< e1d981bfa14b664317285f0f36498f4be4a23406
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- products-cmfplone · PyPI
- products-cmfplone · PyPI
The same CVE-2015-7315 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Plone is an open-source content management system (CMS) built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management. Plone allows site administrators to enable user registration, which allows visitors to create new member accounts. However, a vulnerability in Plone versions 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site without acknowledgment from the site administrator.
Vulnerability Detail
The vulnerability in Plone allows an attacker to bypass the site administrator's approval process for new member registrations. By exploiting this vulnerability, an attacker can create a new member account on a Plone site without the knowledge or consent of the site administrator. This can lead to unauthorized access, privilege escalation, and potential misuse of the site's resources. The vulnerability originates from a flaw in the registration process, which fails to properly validate and enforce administrator approval for new member accounts.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 3.3, < 4.0a14.0a1pip install --upgrade "plone==4.0a1" -
>= 4.0, < 4.1a14.1a1pip install --upgrade "plone==4.1a1" -
>= 4.1, < 4.2a14.2a1pip install --upgrade "plone==4.2a1" -
>= 4.2, < 4.3a14.3a1pip install --upgrade "plone==4.3a1" -
>= 4.3, < 4.3.74.3.7pip install --upgrade "plone==4.3.7" -
>= 5.0a1, < 5.0rc25.0rc2pip install --upgrade "plone==5.0rc2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately feasible, a temporary workaround is to disable user registration on the Plone site. This can be done by accessing the site's administrative interface and navigating to the appropriate settings or configuration section. By disabling user registration, the vulnerability is effectively mitigated as attackers will no longer be able to create new member accounts without administrator approval.
Conclusion
The Plone Remote Member Addition Vulnerability allows remote attackers to add new member accounts to a Plone site without the knowledge or consent of the site administrator. This can lead to unauthorized access, privilege escalation, and potential misuse of the site's resources. To mitigate this vulnerability, it is recommended to upgrade to a patched version of Plone (4.3.7 or 5.0rc2) or disable user registration on the site. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system (CMS) built on top of the Zope application server. It provides a user-friendly interface for managing websites and supports various features such as content creation, collaboration, and workflow management.
The vulnerability allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of the site administrator. By exploiting this vulnerability, an attacker can create a new member account on a Plone site without the knowledge or consent of the site administrator.
The vulnerability can lead to unauthorized access, privilege escalation, and potential misuse of the site's resources. Attackers can create member accounts without administrator approval, gaining unauthorized access to sensitive information or performing malicious actions on the site.
To fix this vulnerability, it is recommended to upgrade to a patched version of Plone. The following versions contain the fix: 4.3.7 and 5.0rc2. Site administrators should update their Plone installations to one of these versions to mitigate the vulnerability.
Yes, a temporary workaround is to disable user registration on the Plone site. By doing so, the vulnerability is effectively mitigated as attackers will no longer be able to create new member accounts without administrator approval.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
