{"id":"PYSEC-2017-54","details":"Plone 3.3.0 through 3.3.6 allows remote attackers to inject headers into HTTP responses.","aliases":["CVE-2015-7318","GHSA-fq9r-8jpm-2222"],"modified":"2026-06-10T17:01:31.019380813Z","published":"2017-09-25T17:29:00Z","references":[{"type":"WEB","url":"https://plone.org/security/hotfix/20150910/header-injection"},{"type":"WEB","url":"https://plone.org/security/hotfix/20150910"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1264796"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2015/09/22/16"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-fq9r-8jpm-2222"}],"affected":[{"package":{"name":"plone","ecosystem":"PyPI","purl":"pkg:pypi/plone"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.3"},{"fixed":"4.0a1"}]}],"versions":["3.3","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.3.6"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/plone/PYSEC-2017-54.yaml"}}],"schema_version":"1.7.5"}