Description
Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | plone | >= 5.0rc1, <= 5.0.4 | — | GHSA-6h8x-73fx-q2h9 |
| PyPI | plone | 5.1a1 | — | GHSA-6h8x-73fx-q2h9 |
| PyPI | plone | >= 5.0rc1, < 5.1a2 | 5.1a2 | PYSEC-2017-57 |