PT-2006-4342 · Zope · Zope

Publicado 2006-07-07 · Atualizado 2022-05-01 · CVE-2006-3458

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zope versions 2.7.0 through 2.9.3

Description The issue allows local users to read arbitrary files due to the failure to disable the raw command when providing untrusted users with restructured text functionality from docutils.

Recommendations For versions 2.7.0 through 2.7.8, disable the raw command to prevent exploitation. For versions 2.8.0 through 2.8.7, disable the raw command to prevent exploitation. For versions 2.9.0 through 2.9.3, disable the raw command to prevent exploitation.

Correção

Identificadores relacionados

CVE-2006-3458

DSA-1113

GHSA-JCJP-QQPQ-PC54

PYSEC-2006-7

Produtos afetados

Zope

Referências · 18

• https://github.com/zopefoundation/Zope · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2006-7.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3458 · Nota de Segurança
• http://zope.org/Products/Zope/Hotfix-2006-07-05/Hotfix-20060705/README.txt · Nota
• http://debian.org/security/2006/dsa-1113 · Aviso do Fabricante
• http://novell.com/linux/security/advisories/2006_19_sr.html · Aviso do Fabricante
• https://usn.ubuntu.com/317-1 · Aviso do Fabricante
• http://secunia.com/advisories/21025 · Aviso do Fabricante
• http://securityfocus.com/bid/18856 · Nota
• http://secunia.com/advisories/20988 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/27636 · Nota
• http://vupen.com/english/advisories/2006/2681 · Aviso do Fabricante
• http://secunia.com/advisories/21130 · Aviso do Fabricante
• http://secunia.com/advisories/21459 · Aviso do Fabricante
• https://github.com/advisories/GHSA-jcjp-qqpq-pc54 · Nota