PT-2023-29223 · Zope · Zope

Dataflake · Published 2023-10-04 · Updated 2024-02-01 · CVE-2023-44389

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 4.8.11 Zope versions prior to 5.8.6

Description Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). This occurs because the title property is displayed unquoted in the breadcrumbs element.

Recommendations For versions prior to 4.8.11, update to version 4.8.11 to resolve the issue. For versions prior to 5.8.6, update to version 5.8.6 to resolve the issue. As a temporary workaround, ensure that only Manager users can edit and view Zope objects in the Zope Management Interface, which is the default configuration.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-44389

GHSA-M755-GXXG-R5QH

PYSEC-2023-193

Affected Products

Zope

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/44xxx/CVE-2023-44389.json · Exploit
• https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d · Patch
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh · Vendor Advisory
• https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a · Patch
• https://osv.dev/vulnerability/CVE-2023-44389 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2023-193 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-44389 · Security Note
• https://osv.dev/vulnerability/GHSA-m755-gxxg-r5qh · Vendor Advisory
• https://github.com/zopefoundation/Zope · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2023-193.yaml · Note
• https://t.me/cvenotify/59209 · Telegram Post