Executive brief
Plone, a popular open-source content management system, was found to have security flaws that could allow unauthorized users to perform administrative actions. By tricking a logged-in administrator into visiting a malicious link, an attacker could create new user accounts or change the permissions of existing groups. This could lead to unauthorized access to sensitive areas of the website or a complete takeover of site management.
Technical details
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities exist in Plone CMS versions prior to 3.1. The flaws are located in the 'join_form' page, which allows for the creation of arbitrary accounts, and the 'prefs_groups_overview' page, which allows for the modification of group privileges. An attacker can exploit these by inducing an authenticated user (such as an administrator) to submit a crafted request to the vulnerable server. Successful exploitation allows for unauthorized account creation and privilege escalation within the CMS. The issue is resolved in Plone version 3.1.
Affected products
- Plone Foundation Plone < 3.1
Timeline
- 2008-03-20: disclosed: Initial NVD publication
- 2022-05-01: advisory: GitHub Advisory published
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41263
- http://plone.org/about/security/advisories/cve-2008-0164
- http://www.procheckup.com/Hacking_Plone_CMS.pdf
- http://plone.org/products/plone-hotfix/releases/CVE-2008-0164
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2008-14.yaml