# CVE-2008-0164: Plone CMS CSRF in join_form and prefs_groups_overview

Source: https://junglewise.ai/threats/cve-2008-0164-plone-cms-csrf-in-join-form-and-prefs-groups-overview  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-05-01. Updated: 2026-06-06  
License: CC BY 4.0 with a link back

CVE-2008-0164 · Severity: high · CVSS 7.5 · Published 2022-05-01

Plone, a popular open-source content management system, was found to have security flaws that could allow unauthorized users to perform administrative actions. By tricking a logged-in administrator into visiting a malicious link, an attacker could create new user accounts or change the permissions of existing groups. This could lead to unauthorized access to sensitive areas of the website or a complete takeover of site management.

Technologies: [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2008-0164 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2008-0164 being exploited in the wild.

**How severe is CVE-2008-0164?** High severity, with a CVSS score of 7.5, published 1 May 2022.

**Which products and versions are affected?** plone (PyPI) ECOSYSTEM:introduced=0,fixed=3.1, ECOSYSTEM:introduced=3.0.5,last_affected=3.0.6.

**Is there a fix for CVE-2008-0164?** Yes. plone (PyPI): upgrade to 3.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2008-0164 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2008-0164?** Check whether you run plone (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- plone (PyPI): upgrade to 3.1 or later

  ```sh
  pip install "plone>=3.1"
  ```


## Technical details

Multiple Cross-Site Request Forgery (CSRF) vulnerabilities exist in Plone CMS versions prior to 3.1. The flaws are located in the 'join_form' page, which allows for the creation of arbitrary accounts, and the 'prefs_groups_overview' page, which allows for the modification of group privileges. An attacker can exploit these by inducing an authenticated user (such as an administrator) to submit a crafted request to the vulnerable server. Successful exploitation allows for unauthorized account creation and privilege escalation within the CMS. The issue is resolved in Plone version 3.1.

## Affected products

- Plone Foundation Plone < 3.1

## Identifiers

- CVE-2008-0164
- GHSA-4j3w-g62x-hrcp
- PYSEC-2008-14
- PYSEC-2008-15

## Timeline

- 2008-03-20: disclosed: Initial NVD publication
- 2022-05-01: advisory: GitHub Advisory published

## References

- [https://exchange.xforce.ibmcloud.com/vulnerabilities/41263](https://exchange.xforce.ibmcloud.com/vulnerabilities/41263)
- [http://plone.org/about/security/advisories/cve-2008-0164](http://plone.org/about/security/advisories/cve-2008-0164)
- [http://www.procheckup.com/Hacking_Plone_CMS.pdf](http://www.procheckup.com/Hacking_Plone_CMS.pdf)
- [http://plone.org/products/plone-hotfix/releases/CVE-2008-0164](http://plone.org/products/plone-hotfix/releases/CVE-2008-0164)
- [https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2008-14.yaml](https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2008-14.yaml)

## Related threats

- [PYSEC-2026-2889 - Plone Privilege Escallation](https://junglewise.ai/threats/cve-2020-7938-plone-privilege-escallation)
- [PYSEC-2026-2964 - Plone unauthorized member addition vulnerability](https://junglewise.ai/threats/cve-2015-7315-plone-unauthorized-member-addition-vulnerability)
- [PYSEC-2026-2962 - Products.CMFPlone XSS in profile home_page property](https://junglewise.ai/threats/cve-2017-1000482-products-cmfplone-xss-in-profile-home-page-property)
- [PYSEC-2026-2963 - Products.CMFPlone Open Redirect Vulnerability](https://junglewise.ai/threats/cve-2017-1000481-products-cmfplone-open-redirect-vulnerability)
- [PYSEC-2026-2967 - Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone](https://junglewise.ai/threats/cve-2021-33507-plone-reflected-cross-site-scripting-vulnerability)