CVE-2016-4043

Advisory

Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.


MLIST:[oss-security] 20160419 Re: CVE Request: Bypass Restricted Python - Plone: http://www.openwall.com/lists/oss-security/2016/04/20/3
CONFIRM:https://plone.org/security/hotfix/20160419/bypass-restricted-python: https://plone.org/security/hotfix/20160419/bypass-restricted-python

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4043
• https://plone.org/security/hotfix/20160419/bypass-restricted-python
• http://www.openwall.com/lists/oss-security/2016/04/20/3