PT-2023-28355 · Zope · Zope

Faris Krivic + 1 · Published 2023-09-21 · Updated 2023-09-25 · CVE-2023-42458

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 4.8.10 and 5.8.5

Description Zope is an open-source web application server with a stored cross site scripting vulnerability for SVG images. The vulnerability can be exploited when an attacker uploads an image and tricks a user into following a specially crafted link. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code.

Recommendations For Zope versions prior to 4.8.10, update to version 4.8.10 to resolve the issue. For Zope versions prior to 5.8.5, update to version 5.8.5 to resolve the issue. As a temporary workaround, make sure the Add Documents, Images, and Files permission is only assigned to trusted roles. By default, only the Manager has this permission.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2023-42458

GHSA-WM8Q-9975-XH5V

Affected Products

Zope

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42458.json · Exploit
• 🔥 http://openwall.com/lists/oss-security/2023/09/22/2 · Exploit
• https://github.com/zopefoundation/Zope/commit/603b0a12881c90a072a7a65e32d47ed898ce37cb · Patch
• https://github.com/zopefoundation/Zope/commit/26a55dbc301db417f47cafda6fe0f983b5690088 · Patch
• https://osv.dev/vulnerability/CVE-2023-42458 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42458 · Security Note
• https://osv.dev/vulnerability/GHSA-wm8q-9975-xh5v · Vendor Advisory
• https://github.com/zopefoundation/Zope · Note
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5v · Note
• https://twitter.com/CVEnew/status/1704901541713358940 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1704932019254276242 · Twitter Post
• https://t.me/cibsecurity/70910 · Telegram Post