CVE-2015-7317

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Kupu 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, and 4.2.0 through 4.2.7 allows remote authenticated users to edit Kupu settings.

Metrics

CVSS 3.0 6.8/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2015/09/22/15Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1264799Issue Tracking, Third Party Advisory
https://plone.org/security/hotfix/20150910Vendor Advisory
https://plone.org/security/hotfix/20150910/privilege-escalation-in-kupuVendor Advisory
http://www.openwall.com/lists/oss-security/2015/09/22/15Mailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1264799Issue Tracking, Third Party Advisory
https://plone.org/security/hotfix/20150910Vendor Advisory
https://plone.org/security/hotfix/20150910/privilege-escalation-in-kupuVendor Advisory

Timeline

Published: Sep 25, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-73187.5Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.CVE-2015-73197.5SQL injection vulnerability in cpabc_appointments_admin_int_calendar_list.inc.php in the Appointment Booking Calendar plugin before 1.1.8 fo CVE-2015-73204.3Multiple cross-site scripting (XSS) vulnerabilities in cpabc_appointments_admin_int_bookings_list.inc.php in the Appointment Booking Calenda CVE-2015-73225.0The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and CVE-2015-73233.5The Secure Meeting (Pulse Collaboration) in Pulse Connect Secure (formerly Juniper Junos Pulse) before 7.1R22.1, 7.4, 8.0 before 8.0R11, and CVE-2015-73246.1Multiple cross-site scripting (XSS) vulnerabilities in helpers/comment.php in the StackIdeas Komento (com_komento) component before 2.0.5 fo CVE-2015-73269.8XML External Entity (XXE) vulnerability in Milton Webdav before 2.7.0.3.CVE-2015-73274.3Mozilla Firefox before 41.0 does not properly restrict the availability of High Resolution Time API times, which allows remote attackers to CVE-2015-73284.7Puppet Server in Puppet Enterprise before 3.8.x before 3.8.3 and 2015.2.x before 2015.2.3 uses world-readable permissions for the private ke CVE-2015-73308.8Puppet Enterprise 2015.3 before 2015.3.1 allows remote attackers to bypass a host whitelist protection mechanism by leveraging the Puppet co CVE-2015-73316.6The mcollective-puppet-agent plugin before 1.11.1 for Puppet allows remote attackers to execute arbitrary code via vectors involving the --s CVE-2015-73337.8MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A local privilege escalation vulnerability was reported