{"action":"Upgrade plone to 4.3.12 or later.","affected":[{"fixed":"4.3.12","introduced":"0"},{"fixed":"5.0.7","introduced":"5.0a1"}],"component":"plone","cve_ids":["CVE-2017-5524"],"ecosystem":"PyPI","epss":0.01918,"exploited":false,"fixed_versions":["4.3.12","5.0.7"],"ghsa_id":"GHSA-p5wr-vp8g-q5p4","id":"tcs_01M5KG7HE87CQKX51TEYDNWZM9","modified_at":"2023-11-08T03:59:21.754689Z","published_at":"2017-03-23T16:59:00Z","references":["https://osv.dev/vulnerability/PYSEC-2017-81","https://plone.org/security/hotfix/20170117/sandbox-escape","http://www.securityfocus.com/bid/95679","http://www.openwall.com/lists/oss-security/2017/01/18/6","https://github.com/advisories/GHSA-p5wr-vp8g-q5p4"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"PYSEC-2017-81","url":"https://osv.dev/vulnerability/PYSEC-2017-81"},{"source":"nvd","source_id":"CVE-2017-5524","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5524"}],"summary":"Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method."}