Privilege Escalation Affecting zope2 package, versions [,2.12.21)[2.13,2.13.11)


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.32% (71st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-PYTHON-ZOPE2-40117
  • published6 Nov 2012
  • disclosed6 Nov 2012
  • creditUnknown

Introduced: 6 Nov 2012

CVE-2012-5489  (opens in a new tab)
CWE-264  (opens in a new tab)

Overview

zope2 is a Zope2 application server / web framework The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

CVSS Scores

version 3.1