Vulnerability · Published Oct 4, 2023 · Assigned by GitHub_M

CVE-2023-44389Zope management interface vulnerable to stored cross site scripting via the title property

Low 3.1

In plain English

A low-severity cross-site scripting in Zope from zopefoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.5%top 58.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	zope	4.8.11	GHSA-m755-gxxg-r5qh
PyPI	zope	5.8.6	GHSA-m755-gxxg-r5qh
PyPI	zope	4.8.11, 5.8.6	PYSEC-2023-193

Affected products (as reported)

Vendor	Product	Versions
zopefoundation	Zope	>= 4.0.0, < 4.8.11>= 5.0.0, < 5.8.6

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh x_refsource_CONFIRM
https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a x_refsource_MISC
https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d x_refsource_MISC