GitHub Advisoryadvisory · PyPI

GHSA-p5wr-vp8g-q5p4 Plone Sandbox Escape

MEDIUM Published 2018-07-12 Modified 2024-10-18 Official page ↗
Aliases
CVE-2017-5524
Ecosystem
PyPI
Packages
Plone
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-134
Reviewed
2020-06-16

Affected packages

• PyPI Plone: >= 4.0, < 4.3.12 → fixed in 4.3.12 • PyPI Plone: >= 5.1a1, < 5.1b1 → fixed in 5.1b1 • PyPI Plone: >= 5.0rc1, < 5.0.7 → fixed in 5.0.7

Description

Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.

Related

Alias · CVE (1)

  • CVE-2017-5524 Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive… vulnerability

Weakness · CWE (1)

  • CWE-134 Use of Externally-Controlled Format String weakness

References