CVE-2015-7318: Plone Remote Header Injection Vulnerability
Summary
CVE-2015-7318: Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses. Affects plone versions >= 3.3, < 4.0a1. Fixed in 4.0a1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is a content management system (CMS) built on top of the Zope application server. It provides an easy-to-use interface for managing websites and web applications. Plone versions 3.3.0 through 3.3.6 are affected by a remote header injection vulnerability. This vulnerability allows remote attackers to inject headers into HTTP responses, potentially leading to various security issues.
Vulnerability Detail
The vulnerability in Plone allows attackers to manipulate HTTP responses by injecting arbitrary headers. This can have several consequences, including but not limited to:
- Cross-site scripting (XSS) attacks
- Cross-site request forgery (CSRF) attacks
- Information disclosure
- Session hijacking
- Cache poisoning
The vulnerability originates from improper input sanitization and validation in the affected Plone versions.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0a1
This is the first release that contains the fix.
pip install --upgrade "plone==4.0a1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to a fixed version is not immediately feasible, a temporary workaround can be implemented by implementing custom header validation and sanitization mechanisms. This can be done by modifying the Plone source code responsible for handling HTTP responses. Here is an example of how to implement header validation in Python:
# Example code for header validation
def validate_headers(headers):
# Perform header validation and sanitization
# Code goes here
return sanitized_headers
Conclusion
The Plone remote header injection vulnerability allows attackers to manipulate HTTP responses by injecting arbitrary headers. This can lead to various security issues. It is recommended to upgrade to a fixed version of Plone (version 4.0a1 or later) to mitigate this vulnerability. If immediate upgrading is not possible, implementing custom header validation and sanitization mechanisms can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is a content management system (CMS) built on top of the Zope application server. It provides an easy-to-use interface for managing websites and web applications.
Plone versions 3.3.0 through 3.3.6 are affected by this vulnerability.
The vulnerability can lead to various security issues, including cross-site scripting (XSS) attacks, cross-site request forgery (CSRF) attacks, information disclosure, session hijacking, and cache poisoning.
To fix this vulnerability, it is recommended to upgrade to a fixed version of Plone (version 4.0a1 or later).
If immediate upgrading is not feasible, a temporary workaround can be implemented by implementing custom header validation and sanitization mechanisms.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
