PT-2006-5469 · Zope+1 · Zope2+1

Jim Fulton · Published 2006-09-19 · Updated 2022-05-01 · CVE-2006-4684

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zope2 versions 2.7.0 through 2.7.9 Zope2 versions 2.8.0 through 2.8.8

Description The issue is related to the docutils module in Zope2, which does not properly handle web pages with reStructuredText (reST) markup. This allows remote attackers to read arbitrary files via a csv table directive.

Recommendations For Zope2 versions 2.7.0 through 2.7.9, update to a version that properly handles reST markup to prevent exploitation. For Zope2 versions 2.8.0 through 2.8.8, update to a version that properly handles reST markup to prevent exploitation. As a temporary workaround, consider disabling the csv table directive in the docutils module until a patch is available.

Fix

Related Identifiers

CVE-2006-4684

DSA-1176-1

GHSA-HM8G-JXJJ-GFM3

PYSEC-2006-8

Affected Products

Zope2

Docutils

References · 13

• http://secunia.com/advisories/21947 · Vendor Advisory
• http://zope.org/Products/Zope/Hotfix-2006-08-21/Hotfix-20060821/README.txt · Patch
• https://osv.dev/vulnerability/PYSEC-2006-8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4684 · Security Note
• http://secunia.com/advisories/21953 · Vendor Advisory
• http://debian.org/security/2006/dsa-1176 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hm8g-jxjj-gfm3 · Vendor Advisory
• https://github.com/zopefoundation/Zope · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2006-8.yaml · Note
• http://mail.zope.org/pipermail/zope-announce/2006-August/002005.html · Note
• http://vupen.com/english/advisories/2006/3653 · Note
• https://github.com/advisories/GHSA-hm8g-jxjj-gfm3 · Note
• http://securityfocus.com/bid/20022 · Note