PT-2023-29223 · Zope · Zope

Dataflake · Publicado 2023-10-04 · Atualizado 2024-02-01 · CVE-2023-44389

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 4.8.11 Zope versions prior to 5.8.6

Description Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). This occurs because the title property is displayed unquoted in the breadcrumbs element.

Recommendations For versions prior to 4.8.11, update to version 4.8.11 to resolve the issue. For versions prior to 5.8.6, update to version 5.8.6 to resolve the issue. As a temporary workaround, ensure that only Manager users can edit and view Zope objects in the Zope Management Interface, which is the default configuration.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-44389

GHSA-M755-GXXG-R5QH

PYSEC-2023-193

Produtos afetados

Zope

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44389.json · Exploit
• https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d · Correção
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh · Aviso do Fabricante
• https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a · Correção
• https://github.com/zopefoundation/Zope · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2023-193.yaml · Nota
• https://osv.dev/vulnerability/CVE-2023-44389 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2023-193 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-44389 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-m755-gxxg-r5qh · Aviso do Fabricante
• https://t.me/cvenotify/59209 · Publicação no Telegram