CVSS 3.0
8.8 highCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2015-7293
Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.
Severity
- EPSS
- 3.0% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- plone:plone
- zope:zope_management_interface
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p3qm-44cf-f8qx | PyPI | plone | <5.0a1 | 5.0a1 |
| PYSEC-2017-51 | PyPI | plone | <5.0a1 | 5.0a1 |
References
- http://packetstormsecurity.com/files/133889/Zope-Management-Interface-4.3.7-Cross-Site-Request-Forgery.html
- https://plone.org/security/hotfix/20151006
- https://pypi.python.org/pypi/plone4.csrffixes
- https://www.exploit-db.com/exploits/38411/
- http://packetstormsecurity.com/files/133889/Zope-Management-Interface-4.3.7-Cross-Site-Request-Forgery.html