CVE-2017-5524

Advisory

Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.


MLIST:[oss-security] 20170118 Re: CVE Request: Plone Sandbox escape vulnerability: http://www.openwall.com/lists/oss-security/2017/01/18/6
CONFIRM:https://plone.org/security/hotfix/20170117/sandbox-escape: https://plone.org/security/hotfix/20170117/sandbox-escape
BID:95679: http://www.securityfocus.com/bid/95679

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5524
• https://plone.org/security/hotfix/20170117/sandbox-escape
• http://www.securityfocus.com/bid/95679
• http://www.openwall.com/lists/oss-security/2017/01/18/6