Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Plone | Plone | 5.0 (including) | 5.0 (including) |
| Plone | Plone | 5.0-rc1 (including) | 5.0-rc1 (including) |
| Plone | Plone | 5.0-rc2 (including) | 5.0-rc2 (including) |
| Plone | Plone | 5.0-rc3 (including) | 5.0-rc3 (including) |
| Plone | Plone | 5.0.1 (including) | 5.0.1 (including) |
| Plone | Plone | 5.0.2 (including) | 5.0.2 (including) |
| Plone | Plone | 5.0.3 (including) | 5.0.3 (including) |
| Plone | Plone | 5.0.4 (including) | 5.0.4 (including) |
| Plone | Plone | 5.1a1 (including) | 5.1a1 (including) |