CVE-2008-0164 Plone Cross-site request forgery (CSRF)
MediumCVSS 4.3
EPSS 0.65%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS 3.0.5 and 3.0.6 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi plone(PyPI) | < 3.1 | 3.1 |
| pypi plone(PyPI) | >= 3.0.5, <= 3.0.6 | No fix listed |
| plone cms | = 3.0.5 | No fix listed |
| plone cms | = 3.0.6 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- plone-joinform-csrf(41263) vdb-entry
- github.com product
- github.com
- github.com
- plone.org vendor-advisory
- plone.org
- 29361 third-party-advisory vendor-advisory
- 3754 third-party-advisory
- www.procheckup.com exploit
- 20080313 PR08-02: Plone CMS Security Research - the Art of Plowning mailing-list
- github.com vendor-advisory