GitHub Advisoryadvisory · PyPI

GHSA-6h8x-73fx-q2h9 Chameleon in Plone allows Authentication Bypass

MEDIUM Published 2022-05-17 Modified 2024-10-18 Official page ↗
Aliases
CVE-2016-4043
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-287
Reviewed
2023-07-31

Affected packages

• PyPI Plone: >= 5.0rc1, <= 5.0.4 (no fix yet) • PyPI Plone: 5.1a1 (no fix yet)

Description

Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.

Related

Alias · CVE (1)

  • CVE-2016-4043 Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References