CVE-2015-7315: Improper Access Control (CWE-284)
value: Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVSS v3 base score: 5.9
Published: 2017-09-25T17:29Z
Repository: https://github.com/zopefoundation/Products.CMFCore
Language: Other
Files changed: Products/CMFCore/CHANGES.txt, Products/CMFCore/RegistrationTool.py
Commit date: 2015-09-12 00:07:02 +0200
Commit message: Make sure RegistrationTool.addMember is not published

Diff: diff --git a/Products/CMFCore/CHANGES.txt b/Products/CMFCore/CHANGES.txt
index 4b4e076..e38fc59 100644
--- a/Products/CMFCore/CHANGES.txt
+++ b/Products/CMFCore/CHANGES.txt
@@ -2,11 +2,12 @@ Products.CMFCore Changelog
 ==========================
 
 2.3.1 (unreleased)
 ------------------
 
-- Nothing changed yet.
+- Make sure RegistrationTool.addMember is not published
+  [vangheem]
 
 
 2.3.0 (2015-02-20)
 ------------------
 
diff --git a/Products/CMFCore/RegistrationTool.py b/Products/CMFCore/RegistrationTool.py
index d789957..f683073 100644
--- a/Products/CMFCore/RegistrationTool.py
+++ b/Products/CMFCore/RegistrationTool.py
@@ -130,18 +130,21 @@ class RegistrationTool(UniqueObject, SimpleItem):
 
     security.declareProtected(AddPortalMember, 'addMember')
     @postonly
     def addMember(self, id, password, roles=('Member',), domains='',
                   properties=None, REQUEST=None):
-        '''Creates a PortalMember and returns it. The properties argument
-        can be a mapping with additional member properties. Raises an
-        exception if the given id already exists, the password does not
-        comply with the policy in effect, or the authenticated user is not
-        allowed to grant one of the roles listed (where Member is a special
-        role that can always be granted); these conditions should be
-        detected before the fact so that a cleaner message can be printed.
-        '''
+        # XXX Do not make this a normal method comment. Doing so makes
+        # this method publishable
+
+        # Creates a PortalMember and returns it. The properties argument
+        # can be a mapping with additional member properties. Raises an
+        # exception if the given id already exists, the password does not
+        # comply with the policy in effect, or the authenticated user is not
+        # allowed to grant one of the roles listed (where Member is a special
+        # role that can always be granted); these conditions should be
+        # detected before the fact so that a cleaner message can be printed.
+
         if not self.isMemberIdAllowed(id):
             raise ValueError(_(u'The login name you selected is already in '
                                u'use or is not valid. Please choose another.'))
 
         failMessage = self.testPasswordValidity(password)

Vulnerable code: - Nothing changed yet.
        '''Creates a PortalMember and returns it. The properties argument
        can be a mapping with additional member properties. Raises an
        exception if the given id already exists, the password does not
        comply with the policy in effect, or the authenticated user is not
        allowed to grant one of the roles listed (where Member is a special
        role that can always be granted); these conditions should be
        detected before the fact so that a cleaner message can be printed.
        '''
Fixed code: - Make sure RegistrationTool.addMember is not published
  [vangheem]
        # XXX Do not make this a normal method comment. Doing so makes
        # this method publishable

        # Creates a PortalMember and returns it. The properties argument
        # can be a mapping with additional member properties. Raises an
        # exception if the given id already exists, the password does not
        # comply with the policy in effect, or the authenticated user is not
        # allowed to grant one of the roles listed (where Member is a special
        # role that can always be granted); these conditions should be
        # detected before the fact so that a cleaner message can be printed.