CVE-2017-5524: Medium severity Plone plone vulnerability

Q: What is the severity of CVE-2017-5524?

CVE-2017-5524 is considered a medium severity vulnerability that allows remote attackers to bypass a sandbox protection mechanism.

Q: How do I fix CVE-2017-5524?

To fix CVE-2017-5524, upgrade to Plone version 5.1b1 or later, or 5.0.7 or later, or 4.3.12 or later.

Q: What software versions are affected by CVE-2017-5524?

CVE-2017-5524 affects Plone versions 4.x through 4.3.11 and 5.x through 5.0.6.

Q: Can CVE-2017-5524 lead to data exposure?

Yes, CVE-2017-5524 can allow attackers to obtain sensitive information by exploiting the vulnerability.

Q: Is there a patch available for CVE-2017-5524?

Yes, a hotfix is available and can be applied by updating to the relevant patched versions of Plone.

Published Mar 23, 2017

Updated

Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.

Affected Software

52 affected componentsFixes available

pip/Plone>=5.1a1<=5.1a2

5.1b1

pip/Plone>=5.0rc1<5.0.7

5.0.7

pip/Plone>=4.0<4.3.12

4.3.12

Plone plone=4.0

Plone plone=4.0.1

Plone plone=4.0.2

Plone plone=4.0.3

Plone plone=4.0.4

Plone plone=4.0.5

Plone plone=4.0.7

Plone plone=4.0.8

Plone plone=4.0.9

Plone plone=4.0.10

Plone plone=4.1

Plone plone=4.1.1

Plone plone=4.1.2

Plone plone=4.1.3

Plone plone=4.1.4

Plone plone=4.1.5

Plone plone=4.1.6

Plone plone=4.2

Plone plone=4.2.1

Plone plone=4.2.2

Plone plone=4.2.3

Plone plone=4.2.4

Plone plone=4.2.5

Plone plone=4.2.6

Plone plone=4.2.7

Plone plone=4.3

Plone plone=4.3.1

Plone plone=4.3.2

Plone plone=4.3.3

Plone plone=4.3.4

Plone plone=4.3.5

Plone plone=4.3.6

Plone plone=4.3.7

Plone plone=4.3.8

Plone plone=4.3.9

Plone plone=4.3.10

Plone plone=4.3.11

Plone plone=5.0

Plone plone=5.0-rc1

Plone plone=5.0-rc2

Plone plone=5.0-rc3

Plone plone=5.0.1

Plone plone=5.0.2

Plone plone=5.0.3

Plone plone=5.0.4

Plone plone=5.0.5

Plone plone=5.0.6

Plone plone=5.1-a1

Plone plone=5.1-a2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/Plone to a version that resolves this vulnerability.
Fixed in 5.1b1
Upgrade
Upgrade pip/Plone to a version that resolves this vulnerability.
Fixed in 5.0.7
Upgrade
Upgrade pip/Plone to a version that resolves this vulnerability.
Fixed in 4.3.12

Event History

Mar 23, 2017

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Data Sourced

via NVD·04:59 PM

RemedyDescriptionSeverityWeaknessAffected Software

Jul 12, 2018

Advisory Published

via GitHub·02:45 PM

Frequently Asked Questions

What is the severity of CVE-2017-5524?

CVE-2017-5524 is considered a medium severity vulnerability that allows remote attackers to bypass a sandbox protection mechanism.

How do I fix CVE-2017-5524?

To fix CVE-2017-5524, upgrade to Plone version 5.1b1 or later, or 5.0.7 or later, or 4.3.12 or later.

What software versions are affected by CVE-2017-5524?

CVE-2017-5524 affects Plone versions 4.x through 4.3.11 and 5.x through 5.0.6.

Can CVE-2017-5524 lead to data exposure?