Zope does not properly restrict access to the getRoles method
Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2000-0725US | high7.2 | — | ||
Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.debian.org/security/2000/20000821WEB
- http://www.redhat.com/support/errata/RHSA-2000-052.htmlWEB
- http://www.zope.org/Products/Zope/Hotfix_08_09_2000/security_alertWEB
- https://github.com/advisories/GHSA-9cmq-pj6p-hgwfADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2000-0725ADVISORY
- https://pypi.org/project/zopePACKAGE
- https://web.archive.org/web/20010219192346/http://archives.neohapsis.com/archives/bugtraq/2000-08/0198.htmlWEB
- https://web.archive.org/web/20010219192441/http://archives.neohapsis.com/archives/bugtraq/2000-08/0259.htmlWEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan