PT-2021-19820 · Zope · Zope

Dataflake · Published 2021-05-21 · Updated 2022-04-06 · CVE-2021-32633

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zope versions prior to 5.2 and 4.6 Zope versions prior to 5.21 and 4.6.1

Description Zope is an open-source web application server. In Zope, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this issue. The problem has been fixed in Zope 5.2 and 4.6.

Recommendations For Zope versions prior to 5.2 and 4.6, update to Zope 5.2 or 4.6 to resolve the issue. For Zope versions prior to 5.21 and 4.6.1, update to Zope 5.21 or 4.6.1 to resolve the issue. As a temporary workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-12

CWE-22

Related Identifiers

CVE-2021-32633

GHSA-5PR9-V234-JW36

GHSA-5VQ5-PG3R-9PH3

GHSA-962M-M8JW-8WRR

GHSA-RPCG-F9Q6-2MQ6

PYSEC-2021-104

PYSEC-2021-88

Affected Products

Zope

References · 27

• 🔥 https://cyllective.com/blog/post/plone-authenticated-rce-cve-2021-32633 · Exploit
• https://github.com/zopefoundation/Zope/commit/1f8456bf1f908ea46012537d52bd7e752a532c91 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32633 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-88 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5pr9-v234-jw36 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rpcg-f9q6-2mq6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32633 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32674 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-104 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5vq5-pg3r-9ph3 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-962m-m8jw-8wrr · Vendor Advisory
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-rpcg-f9q6-2mq6 · Note
• https://github.com/zopefoundation/Zope/commit/1d897910139e2c0b11984fc9b78c1da1365bec21 · Note
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 · Note
• https://github.com/zopefoundation/Zope · Note