Zope does not properly verify the access for objects with proxy roles
Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2002-0170US | high7.5 | — | ||
Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configurati… | ||||
02
references
External citations — patches, advisories, analysis.
- http://marc.info/?l=bugtraq&m=101503023511996&w=2WEB
- http://www.redhat.com/support/errata/RHSA-2002-060.htmlWEB
- https://github.com/zopefoundation/ZopePACKAGE
- https://launchpad.net/zope2/+milestone/2.4.4WEB
- https://launchpad.net/zope2/+milestone/2.5.1WEB
- https://nvd.nist.gov/vuln/detail/CVE-2002-0170ADVISORY
- https://web.archive.org/web/20021120034302/http://online.securityfocus.com/bid/4229WEB
- https://web.archive.org/web/20070914020022/http://xforce.iss.net/xforce/xfdb/8334WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan