GHSA-25jh-5h5r-h33m

Suggest an improvement
Source
https://github.com/advisories/GHSA-25jh-5h5r-h33m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-25jh-5h5r-h33m/GHSA-25jh-5h5r-h33m.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-25jh-5h5r-h33m
Aliases
Published
2022-05-17T04:32:23Z
Modified
2024-02-16T07:56:07.046236Z
Summary
Plone Sandbox Bypass
Details

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors.

References

Affected packages

PyPI / plone

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.3

Affected versions

3.*

3.2a1
3.2rc1
3.2
3.2.1
3.2.2
3.2.3
3.3b1
3.3rc1
3.3rc2
3.3rc3
3.3rc4
3.3rc5
3.3
3.3.1
3.3.2
3.3.3
3.3.4
3.3.5
3.3.6

4.*

4.0a1
4.0a2
4.0a3
4.0a4
4.0a5
4.0b1
4.0b2
4.0b3
4.0b4
4.0b5
4.0rc1
4.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.1a1
4.1a2
4.1a3
4.1b1
4.1b2
4.1rc2
4.1rc3
4.1
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.2a1
4.2a2
4.2b1
4.2b2
4.2rc1
4.2rc2
4.2
4.2.1
4.2.2

PyPI / plone

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.3a1
Fixed
4.3b1

Affected versions

4.*

4.3a1
4.3a2