[GHSA-984m-rj28-8c6x] Plone unauthorized member addition vulnerability

[nikpivkin]

Updates

• Affected products
• CVSS v3

Comments
The range of the Products.CMFPlone entry for 3.3 to 4.3 should end at < 4.3.7, not < 4.3.6.

The advisory text says "4.3.0 through 4.3.6", and the Plone entry of the same advisory already ends at <= 4.3.6. The fix commit for the 4.3 branch, plone/Products.CMFPlone@9f0111f, is in tag 4.3.7 and not in tag 4.3.6.

So Products.CMFPlone 4.3.6 is still vulnerable but is outside the current range.

[Copilot]

Copilot review overview

🟢 Approval recommended

The corrected metadata now includes vulnerable version 4.3.6 and agrees with the documented 4.3.7 fix.

Review effort: Balanced
Findings: None

What changed in this PR

Aligns the advisory with the confirmed Products.CMFPlone 4.3.7 fix release.

Changes:

• Removes the stale < 4.3.6 affected-range override.
• Removes the CVSS v3 vector and updates the modification timestamp.

File	Description
GHSA-984m-rj28-8c6x.json	Corrects affected-version metadata and severity data.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[nikpivkin]

The removal of the CVSS_V3 score is not intended. The advisory has both a CVSS 3.1 and a CVSS 4.0 vector, and the form seems to keep only one of them. Please keep CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N. The only change I meant is the range of the Products.CMFPlone entry.

[nikpivkin]

I opened #9628 about the form dropping the CVSS 3.1 vector.