PT-2009-5090 · Zope · Zeo+1

Jim Fulton · Publicado 2009-09-08 · Atualizado 2022-05-02 · CVE-2009-2701

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Zope Object Database (ZODB) versions 3.8.0 through 3.8.2 Zope Object Database (ZODB) versions 3.9.x prior to 3.9.0c2

Description The issue affects the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB). When certain ZEO database sharing and blob support are enabled, remote authenticated users can read or delete arbitrary files via unknown vectors.

Recommendations For Zope Object Database (ZODB) versions 3.8.0 through 3.8.2, update to version 3.8.3 or later. For Zope Object Database (ZODB) versions 3.9.x prior to 3.9.0c2, update to version 3.9.0c2 or later.

Correção

Identificadores relacionados

CVE-2009-2701

GHSA-M52M-2QPX-9J4J

PYSEC-2009-10

Produtos afetados

Zeo

Zodb

Referências · 9

• https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-10.yaml · Nota
• https://github.com/zopefoundation/ZODB3 · Nota
• https://osv.dev/vulnerability/PYSEC-2009-10 · Aviso do Fabricante
• http://pypi.python.org/pypi/ZODB3/3.8.3 · Correção
• https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2009-2701 · Nota de Segurança
• http://vupen.com/english/advisories/2009/2534 · Aviso do Fabricante
• http://pypi.python.org/pypi/ZODB3/3.9.0c2 · Correção
• https://osv.dev/vulnerability/GHSA-m52m-2qpx-9j4j · Aviso do Fabricante