CVE-2016-4043

medium

Published 2022-05-17 · Modified 2023-11-08

CVSS v3

4.9

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

CVSS v2

3.5

VIR risk

4.9

Description

Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.

Predictions

Exploit likelihood

59%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: cve@mitre.org — https://plone.org/security/hotfix/20160419/bypass-restricted-python

Package impact

Ecosystem	Package	Vulnerable	Fixed
PyPI	plone	`>=5.0rc1,<=5.0.4`
PyPI	plone
PyPI	plone	`>=5.0rc1,<5.1a2`	`5.1a2`

Application impact

Vendor	Product	Versions
plone	plone	`5.0`
plone	plone	`5.0.1`
plone	plone	`5.0.2`
plone	plone	`5.0.3`
plone	plone	`5.0.4`
plone	plone	`5.1a1`

References

https://nvd.nist.gov/vuln/detail/CVE-2016-4043
https://github.com/plone/Plone
https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2017-57.yaml
https://plone.org/security/hotfix/20160419/bypass-restricted-python
http://www.openwall.com/lists/oss-security/2016/04/20/3

CWEs

CWE-264

Verify integrity in audit chain (admin only). AS-IS.