CVE Vulnerabilities

CVE-2017-5524

Use of Externally-Controlled Format String

Published: Mar 23, 2017 | Modified: Apr 20, 2025
CVSS 3.x
4.3
MEDIUM
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:L/Au:S/C:P/I:N/A:N
RedHat/V2
RedHat/V3
3.5 LOW
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Ubuntu

Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.

Weakness

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Affected Software

Name Vendor Start Version End Version
Plone Plone 4.0 (including) 4.0 (including)
Plone Plone 4.0.1 (including) 4.0.1 (including)
Plone Plone 4.0.2 (including) 4.0.2 (including)
Plone Plone 4.0.3 (including) 4.0.3 (including)
Plone Plone 4.0.4 (including) 4.0.4 (including)
Plone Plone 4.0.5 (including) 4.0.5 (including)
Plone Plone 4.0.7 (including) 4.0.7 (including)
Plone Plone 4.0.8 (including) 4.0.8 (including)
Plone Plone 4.0.9 (including) 4.0.9 (including)
Plone Plone 4.0.10 (including) 4.0.10 (including)
Plone Plone 4.1 (including) 4.1 (including)
Plone Plone 4.1.1 (including) 4.1.1 (including)
Plone Plone 4.1.2 (including) 4.1.2 (including)
Plone Plone 4.1.3 (including) 4.1.3 (including)
Plone Plone 4.1.4 (including) 4.1.4 (including)
Plone Plone 4.1.5 (including) 4.1.5 (including)
Plone Plone 4.1.6 (including) 4.1.6 (including)
Plone Plone 4.2 (including) 4.2 (including)
Plone Plone 4.2.1 (including) 4.2.1 (including)
Plone Plone 4.2.2 (including) 4.2.2 (including)
Plone Plone 4.2.3 (including) 4.2.3 (including)
Plone Plone 4.2.4 (including) 4.2.4 (including)
Plone Plone 4.2.5 (including) 4.2.5 (including)
Plone Plone 4.2.6 (including) 4.2.6 (including)
Plone Plone 4.2.7 (including) 4.2.7 (including)
Plone Plone 4.3 (including) 4.3 (including)
Plone Plone 4.3.1 (including) 4.3.1 (including)
Plone Plone 4.3.2 (including) 4.3.2 (including)
Plone Plone 4.3.3 (including) 4.3.3 (including)
Plone Plone 4.3.4 (including) 4.3.4 (including)
Plone Plone 4.3.5 (including) 4.3.5 (including)
Plone Plone 4.3.6 (including) 4.3.6 (including)
Plone Plone 4.3.7 (including) 4.3.7 (including)
Plone Plone 4.3.8 (including) 4.3.8 (including)
Plone Plone 4.3.9 (including) 4.3.9 (including)
Plone Plone 4.3.10 (including) 4.3.10 (including)
Plone Plone 4.3.11 (including) 4.3.11 (including)
Plone Plone 5.0 (including) 5.0 (including)
Plone Plone 5.0-rc1 (including) 5.0-rc1 (including)
Plone Plone 5.0-rc2 (including) 5.0-rc2 (including)
Plone Plone 5.0-rc3 (including) 5.0-rc3 (including)
Plone Plone 5.0.1 (including) 5.0.1 (including)
Plone Plone 5.0.2 (including) 5.0.2 (including)
Plone Plone 5.0.3 (including) 5.0.3 (including)
Plone Plone 5.0.4 (including) 5.0.4 (including)
Plone Plone 5.0.5 (including) 5.0.5 (including)
Plone Plone 5.0.6 (including) 5.0.6 (including)
Plone Plone 5.1-a1 (including) 5.1-a1 (including)
Plone Plone 5.1-a2 (including) 5.1-a2 (including)

Potential Mitigations

References