Log in Start free

Vulnerability · Published May 21, 2021 · Assigned by GitHub_M

CVE-2021-32633Remote Code Execution via traversal in TAL expressions

Medium 6.8

In plain English

A medium-severity path traversal in Zope from zopefoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.9% (higher than 79% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)1.9%top 20.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIzope4.6GHSA-5pr9-v234-jw36
PyPIzope5.2GHSA-5pr9-v234-jw36
PyPIzope4.6GHSA-962m-m8jw-8wrr
PyPIzope5.2GHSA-962m-m8jw-8wrr
PyPIzope4.6, 5.2PYSEC-2021-88

Affected products (as reported)

VendorProductVersions
zopefoundation Zope < 4.6>= 5.0, < 5.2

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References