Baja

Zope vulnerable to Stored Cross Site Scripting with SVG images

Publicada: 21.09.2023
Actualizado: 11.10.2026 15:17

Impact

There is a stored cross site scripting vulnerability for SVG images.

Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link.

All versions of Zope are impacted on sites that allow untrusted users to upload images.

Patches

Patches will be released in Zope 4.8.10 and 5.8.5.

Workarounds

Make sure the "Add Documents, Images, and Files" permission is only assigned to trusted roles. By default only the Manager has this permission.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	zope	< 4.8.10, >= 5.8.0, < 5.8.5	4.8.10, 5.8.5

Referencias

Puntuación CVSS 3.7/10

Vector CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Debilidad (CWE): CWE-79
Plataforma: Python (PyPI)
Paquete: zope
Publicada: 21.09.2023
Actualizado: 11.10.2026 15:17

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-2077 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-wm8q-9975-xh5v - CC BY 4.0

Historial de vulnerabilidades: zope

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (17) en el archivo

Entradas en total: 17
Primera → última: 05.2021 11.2024
Sin corrección: 4
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Alta 8
Media 6
Baja 2

Divulgaciones por año

2021: 4
2022: 9
2023: 3
2024: 1
2025: 0
2026: 0

04.11.2024

Access control vulnerable to user data deletion by anonynmous users

Crítica · 9.1 CVE-2024-51734 < 5.11.1 5.11.1
21.09.2023

Zope vulnerable to Stored Cross Site Scripting with SVG images esta entrada

Baja · 3.7 CVE-2023-42458 < 4.8.10, >= 5.8.0, < 5.8.5 4.8.10, 5.8.5
30.04.2022

ZCatalog plug-in for Zope allows anonymous users to bypass access restrictions

Alta CVE-2002-0688 >= 2.4.0, < 2.6.0 2.6.0
30.04.2022

Zope does not properly verify the access for objects with proxy roles

Alta CVE-2002-0170 >= 2.2.0, < 2.4.4, >= 2.5.0, < 2.5.1 2.4.4, 2.5.1
30.04.2022

Zope does not properly perform security registration for legacy names

Alta CVE-2000-1211 >= 2.2.0, <= 2.2.4 sin corrección
30.04.2022

Zope does not properly restrict access to the getRoles method

Alta CVE-2000-0725 < 2.2.1 2.2.1
30.04.2022

Zope DTML implementation Improper Authentication

Alta CVE-2000-0062 >= 2.2.0, <= 2.2.4 sin corrección
02.08.2021

Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope

Alta · 7.5 CVE-2021-32811 >= 4.0, < 4.6.3, >= 5.0, < 5.3 4.6.3, 5.3
08.06.2021

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TA

Alta · 8.8 CVE-2021-32674 >= 4.0, < 4.6.1, >= 5.0, < 5.2.1 4.6.1, 5.2.1
21.05.2021

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default

Alta · 8.8 CVE-2021-32633 < 4.6, >= 5.0, < 5.2 4.6, 5.2

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación