CVE-2017-5524 Plone Sandbox Escape
Remote attackers can bypass sandbox protections in Plone to obtain sensitive information via Python string format exploitation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-5524?
CVE-2017-5524 is a medium-severity vulnerability in Plone Plone, published on 23 Mar 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.
Weakness: CWE-134
Which versions are affected by CVE-2017-5524?
7 open source packages ship an affected version, including plone and Plone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
plone PyPI | All versions | 4.3.12, 5.0.7 |
plone PyPI | From 4.0 | 4.3.12 |
plone PyPI | From 5.0rc1 | 5.0.7 |
plone PyPI | From 5.1a1 | 5.1b1 |
Plone PyPI | From 4.0 | 4.3.12 |
Plone PyPI | From 5.0rc1 | 5.0.7 |
1 more packages
Plone PyPI | From 5.1a1 | 5.1b1 |
Products include Plone Plone.
How do I fix CVE-2017-5524?
Upgrade plone to a fixed version for your release line: 4.3.12, 5.0.7 or 5.1b1.
Is CVE-2017-5524 being exploited?
There is no known exploitation of CVE-2017-5524 in the wild and no public exploit code.
Other vulnerabilities in Plone Plone
Sources
Also known as GHSA-p5wr-vp8g-q5p4, PYSEC-2017-81.