CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-44389 – Zope management interface vulnerable to stored cross site scripting via the title property
https://notcve.org/view.php?id=CVE-2023-44389
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6. Zope es un servidor de aplicaciones web de código abierto. • https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2023-42458 – Zope vulnerable to Stored Cross Site Scripting with SVG images
https://notcve.org/view.php?id=CVE-2023-42458
Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in Zope 4.8.10 and 5.8.5. • http://www.openwall.com/lists/oss-security/2023/09/22/2 https://github.com/zopefoundation/Zope/commit/26a55dbc301db417f47cafda6fe0f983b5690088 https://github.com/zopefoundation/Zope/commit/603b0a12881c90a072a7a65e32d47ed898ce37cb https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5v • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 7.7EPSS: 0%CPEs: 5EXPL: 0CVE-2023-41050 – Information disclosure through Python's "format" functionality in Zope AccessControl
https://notcve.org/view.php?id=CVE-2023-41050
AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. `AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. • https://github.com/zopefoundation/AccessControl/commit/6bc32692e0d4b8d5cf64eae3d19de987c7375bc9 https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-8xv7-89vj-q48c • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2021-32811 – Remote Code Execution via Script (Python) objects under Python 3
https://notcve.org/view.php?id=CVE-2021-32811
Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional `Products.PythonScripts` add-on package installed. By default, one must have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. • https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf https://github.com/zopefoundation/Zope/commit/f72a18dda8e9bf2aedb46168761668464a4be988 https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j8fr • CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-32674 – Remote Code Execution via traversal in TAL expressions
https://notcve.org/view.php?id=CVE-2021-32674
Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use. • https://github.com/zopefoundation/Zope/commit/1d897910139e2c0b11984fc9b78c1da1365bec21 https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 https://github.com/zopefoundation/Zope/security/advisories/GHSA-rpcg-f9q6-2mq6 https://pypi.org/project/Zope • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •