CVE-2015-7317 Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings.
MediumCVSS 6.8
EPSS 1.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kupu project kupu | <= 1.4.16 | No fix listed |
| plone | = 3.3 | No fix listed |
| plone | = 3.3.1 | No fix listed |
| plone | = 3.3.2 | No fix listed |
| plone | = 3.3.3 | No fix listed |
| plone | = 3.3.4 | No fix listed |
| plone | = 3.3.5 | No fix listed |
| plone | = 3.3.6 | No fix listed |
| plone | = 4.0 | No fix listed |
| plone | = 4.0.1 | No fix listed |
| plone | = 4.0.2 | No fix listed |
| plone | = 4.0.3 | No fix listed |
| plone | = 4.0.4 | No fix listed |
| plone | = 4.0.5 | No fix listed |
| plone | = 4.0.6.1 | No fix listed |
| plone | = 4.0.7 | No fix listed |
| plone | = 4.0.8 | No fix listed |
| plone | = 4.0.9 | No fix listed |
| plone | = 4.0.10 | No fix listed |
| plone | = 4.1 | No fix listed |
| plone | = 4.1.1 | No fix listed |
| plone | = 4.1.2 | No fix listed |
| plone | = 4.1.3 | No fix listed |
| plone | = 4.1.4 | No fix listed |
| plone | = 4.1.5 | No fix listed |
Show 9 more
| Product | Affected versions | Fixed in |
|---|---|---|
| plone | = 4.1.6 | No fix listed |
| plone | = 4.2 | No fix listed |
| plone | = 4.2.1 | No fix listed |
| plone | = 4.2.2 | No fix listed |
| plone | = 4.2.3 | No fix listed |
| plone | = 4.2.4 | No fix listed |
| plone | = 4.2.5 | No fix listed |
| plone | = 4.2.6 | No fix listed |
| plone | = 4.2.7 | No fix listed |
References
- [oss-security] 20150922 Re: CVE Request: Plone Privilege Escalation mailing-list third-party-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- plone.org vendor-advisory
- plone.org vendor-advisory