CVE-2017-1000483 Plone Unauthorized Access Vulnerability
Attackers can access private content by exploiting str.format in Plone through-the-web templates and scripts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1000483?
CVE-2017-1000483 is a medium-severity code injection vulnerability in Plone Plone, published on 3 Jan 2018. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Accessing private content via str.format in through-the-web templates and scripts in Plone 2.5-5.1rc1. This improves an earlier hotfix. Since the format method was introduced in Python 2.6, this part of the hotfix is only relevant for Plone 4 and 5.
Which versions are affected by CVE-2017-1000483?
5 open source packages ship an affected version, including plone and Plone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
plone PyPI | From 2.5 | 4.3.16, 5.1.0 |
plone PyPI | From 2.5 | 4.3.16 |
plone PyPI | From 5.0 | 5.1.0 |
Plone PyPI | From 2.5 | 4.3.16 |
Plone PyPI | From 5.0 | 5.1.0 |
Products include Plone Plone.
How do I fix CVE-2017-1000483?
Upgrade plone to a fixed version for your release line: 4.3.16 or 5.1.0.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-1000483 being exploited?
There is no known exploitation of CVE-2017-1000483 in the wild and no public exploit code.
Other vulnerabilities in Plone Plone
Sources
Also known as GHSA-qc57-h2f7-p4hx, PYSEC-2018-72.