CVE-2015-7317 – Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and

Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings.

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7317

Reference (s):

• https://bugzilla.redhat.com/show_bug.cgi?id=1264799
• https://plone.org/security/hotfix/20150910
• https://plone.org/security/hotfix/20150910/privilege-escalation-in-kupu
• MLIST:[oss-security] 20150922 Re: CVE Request: Plone Privilege Escalation
• URL: http://www.openwall.com/lists/oss-security/2015/09/22/15