PT-2018-5248 · Plone Foundation · Plone

Published 2018-01-03 · Updated 2022-05-13 · CVE-2017-1000483

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1

Description The issue allows accessing private content via str.format in through-the-web templates and scripts. This improves an earlier hotfix, specifically relevant for Plone 4 and 5 due to the introduction of the format method in Python 2.6.

Recommendations For Plone versions 2.5 through 5.1rc1, consider disabling the use of str.format in through-the-web templates and scripts as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2017-1000483

GHSA-QC57-H2F7-P4HX

PYSEC-2018-72

Affected Products

Plone

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2017-1000483 · Security Note
• https://plone.org/security/hotfix/20171128/sandbox-escape · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000483 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-72 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qc57-h2f7-p4hx · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2018-72.yaml · Note
• https://github.com/plone/Plone · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000483 · Note