PT-2002-1713 · Zope · Zope

Published 2002-07-23 · Updated 2022-04-30 · CVE-2002-0688

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zope versions 2.4.0 through 2.5.1

Description The issue allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes due to the ZCatalog plug-in index support capability.

Recommendations For versions 2.4.0 through 2.5.1, consider restricting access to the ZCatalog plug-in index to prevent anonymous users and untrusted code from bypassing access restrictions.

Fix

Related Identifiers

CVE-2002-0688

DSA-490

GHSA-7944-H5RW-QMJX

Affected Products

Zope

References · 13

• http://redhat.com/support/errata/RHSA-2002-060.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0688 · Security Note
• https://osv.dev/vulnerability/GHSA-7944-h5rw-qmjx · Vendor Advisory
• http://debian.org/security/2004/dsa-490 · Vendor Advisory
• http://zope.org/Products/Zope/Hotfix_2002-06-14/security_alert · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0688 · Note
• https://web.archive.org/web/20020810160608/http://zope.org/Products/Zope/Hotfix_2002-06-14/security_alert · Note
• http://securityfocus.com/bid/5812 · Note
• https://web.archive.org/web/20021206023914/http://rhn.redhat.com/errata/RHSA-2002-060.html · Note
• https://web.archive.org/web/20021223212650/http://online.securityfocus.com/bid/5812 · Note
• https://web.archive.org/web/20020822025750/http://iss.net/security_center/static/9610.php · Note
• https://web.archive.org/web/20070430090648/http://debian.org/security/2004/dsa-490 · Note
• http://iss.net/security_center/static/9610.php · Note