PT-2021-19945 · Unknown+1 · Products.Pythonscripts+1

Dataflake · Published 2021-07-30 · Updated 2022-12-02 · CVE-2021-32811

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zope versions prior to 4.6.3 and 5.3

Description Zope is an open-source web application server with a remote code execution security issue. The issue affects Zope deployments using Python 3, running Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and having the optional Products.PythonScripts add-on package installed. By default, only users with the admin-level Zope "Manager" role can add or edit Script (Python) objects through the web. Sites that allow untrusted users to add or edit these scripts through the web are at risk.

Recommendations For Zope versions prior to 4.6.3 and 5.3, restrict adding or editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role, and adding or editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.

Fix

RCE

Prototype Pollution

Weakness Enumeration

CWE-1321

CWE-915

Related Identifiers

CVE-2021-32811

GHSA-G4GQ-J4P2-J8FR

GHSA-QCX9-J53G-CCGF

PYSEC-2021-335

PYSEC-2021-368

PYSEC-2021-370

PYSEC-2021-875

Affected Products

Products.Pythonscripts

Zope

References · 26

• https://github.com/zopefoundation/Zope/commit/f72a18dda8e9bf2aedb46168761668464a4be988 · Patch
• https://osv.dev/vulnerability/PYSEC-2021-875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32811 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-32811 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32811 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g4gq-j4p2-j8fr · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-335 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32811 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32811 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-368 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qcx9-j53g-ccgf · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-370 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32807 · Security Note
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j8fr · Note
• https://github.com/zopefoundation/Zope · Note