Improper Access Control Affecting zodb3 package, versions [3.8.0a1,3.8.3) [3.9.0,3.9.0c2)
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-ZODB3-6165818
- published 17 Jan 2024
- disclosed 8 Sep 2009
- credit Unknown
Introduced: 8 Sep 2009
CVE-2009-2701 Open this link in a new tabHow to fix?
Upgrade ZODB3 to version 3.8.3, 3.9.0c2 or higher.
Overview
ZODB3 is a ZODB3 - Meta release for ZODB, persistent, BTrees and ZEO
Affected versions of this package are vulnerable to Improper Access Control due to improper handling of ZEO database sharing and blob support. An attacker can read or delete arbitrary files by exploiting unknown vectors.
Note
This vulnerability is only exploitable when:
Using ZEO to share a database among multiple applications or application instances,
Allowing untrusted clients to connect to your ZEO server, and the ZEO server is configured to support blobs.