CVE-2008-0164: Plone Cross-site request forgery (CSRF)

May 1, 2022 (updated June 6, 2026)

Multiple cross-site request forgery (CSRF) vulnerabilities in Plone CMS before 3.1 allow remote attackers to (1) add arbitrary accounts via the join_form page and (2) change the privileges of arbitrary groups via the prefs_groups_overview page.

References

exchange.xforce.ibmcloud.com/vulnerabilities/41263
github.com/advisories/GHSA-4j3w-g62x-hrcp
github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2008-14.yaml
github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2008-15.yaml
nvd.nist.gov/vuln/detail/CVE-2008-0164

Code Behaviors & Features

Detect and mitigate CVE-2008-0164 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →