PT-2009-5090 · Zope · Zeo+1

Jim Fulton · Published 2009-09-08 · Updated 2022-05-02 · CVE-2009-2701

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Zope Object Database (ZODB) versions 3.8.0 through 3.8.2 Zope Object Database (ZODB) versions 3.9.x prior to 3.9.0c2

Description The issue affects the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB). When certain ZEO database sharing and blob support are enabled, remote authenticated users can read or delete arbitrary files via unknown vectors.

Recommendations For Zope Object Database (ZODB) versions 3.8.0 through 3.8.2, update to version 3.8.3 or later. For Zope Object Database (ZODB) versions 3.9.x prior to 3.9.0c2, update to version 3.9.0c2 or later.

Fix

Related Identifiers

CVE-2009-2701

GHSA-M52M-2QPX-9J4J

PYSEC-2009-10

Affected Products

Zeo

Zodb

References · 9

• https://osv.dev/vulnerability/PYSEC-2009-10 · Vendor Advisory
• http://pypi.python.org/pypi/ZODB3/3.8.3 · Patch
• https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-2701 · Security Note
• http://vupen.com/english/advisories/2009/2534 · Vendor Advisory
• http://pypi.python.org/pypi/ZODB3/3.9.0c2 · Patch
• https://osv.dev/vulnerability/GHSA-m52m-2qpx-9j4j · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-10.yaml · Note
• https://github.com/zopefoundation/ZODB3 · Note