What is GHSA-6h8x-73fx-q2h9?

GHSA-6h8x-73fx-q2h9 is a security advisory published by GitHub Security Advisories with Medium severity. Chameleon in Plone allows Authentication Bypass

Which CVE IDs does GHSA-6h8x-73fx-q2h9 cover?

GHSA-6h8x-73fx-q2h9 covers the following CVE IDs: CVE-2016-4043. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6h8x-73fx-q2h9?

GHSA-6h8x-73fx-q2h9 has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

Which products are affected by GHSA-6h8x-73fx-q2h9?

GHSA-6h8x-73fx-q2h9 affects 2 products, including: pip/Plone:\u003e= 5.0rc1, \u003c= 5.0.4; pip/Plone:= 5.1a1.

GHSA-6h8x-73fx-q2h9MediumCVSS 4.9

Chameleon in Plone allows Authentication Bypass

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

October 18, 2024

🔗 CVE IDs covered (1)

CVE-2016-4043 →

📋 Description

Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.

🎯 Affected products2

pip/Plone:>= 5.0rc1, <= 5.0.4
pip/Plone:= 5.1a1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2016-4043
https://plone.org/security/hotfix/20160419/bypass-restricted-python
http://www.openwall.com/lists/oss-security/2016/04/20/3
https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-57.yaml
https://github.com/advisories/GHSA-6h8x-73fx-q2h9