CVE-2016-4043: Chameleon in Plone allows Authentication Bypass

May 17, 2022 (updated October 18, 2024)

Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.

References

github.com/advisories/GHSA-6h8x-73fx-q2h9
github.com/plone/Plone
github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-57.yaml
nvd.nist.gov/vuln/detail/CVE-2016-4043
plone.org/security/hotfix/20160419/bypass-restricted-python

Detect and mitigate CVE-2016-4043 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →