CVE-2015-7293

Advisory

Plone 4.3.9 includes a fix for CVE-2015-7293: Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.
https://plone.org/security/hotfix/20151006

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Multiple cross-site request forgery (CSRF) vulnerabilities in Zope Management Interface 4.3.7 and earlier, and Plone before 5.x.


EXPLOIT-DB:38411: https://www.exploit-db.com/exploits/38411/
MISC:http://packetstormsecurity.com/files/133889/Zope-Management-Interface-4.3.7-Cross-Site-Request-Forgery.html: http://packetstormsecurity.com/files/133889/Zope-Management-Interface-4.3.7-Cross-Site-Request-Forgery.html
CONFIRM:https://plone.org/security/hotfix/20151006: https://plone.org/security/hotfix/20151006
CONFIRM:https://pypi.python.org/pypi/plone4.csrffixes: https://pypi.python.org/pypi/plone4.csrffixes

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7293
• https://www.exploit-db.com/exploits/38411/
• https://pypi.python.org/pypi/plone4.csrffixes
• https://plone.org/security/hotfix/20151006
• http://packetstormsecurity.com/files/133889/Zope-Management-Interface-4.3.7-Cross-Site-Request-Forgery.html