Description
Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | plone | >= 4.0, < 4.3.12 | 4.3.12 | GHSA-p5wr-vp8g-q5p4 |
| PyPI | plone | >= 5.1a1, < 5.1b1 | 5.1b1 | GHSA-p5wr-vp8g-q5p4 |
| PyPI | plone | >= 5.0rc1, < 5.0.7 | 5.0.7 | GHSA-p5wr-vp8g-q5p4 |
| PyPI | plone | < 4.3.12 · >= 5.0a1, < 5.0.7 | 4.3.12, 5.0.7 | PYSEC-2017-81 |