GHSA-m755-gxxg-r5qh
Zope management interface vulnerable to stored cross site scripting via the title property
At a glance
- Published
- Updated
- CVE
- CVE-2023-44389
- Aliases
- PYSEC-2023-193
- CVSS_V3
- CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
Description
### Impact The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI) because the title property is displayed unquoted in the breadcrumbs element. All versions of Zope 4 and Zope 5 are affected. ### Patches Patches will be released with Zope versions 4.8.11 and 5.8.6. ### Workarounds Make sure only Manager users can edit and view Zope objects in the Zope Management Interface. This is the default.
Affected packages
| Package | Versions |
|---|---|
| PyPI · zope | introduced 4.0.0, fixed 4.8.11 |
| PyPI · zope | introduced 5.0.0, fixed 5.8.6 |
References
- https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh WEB
- https://nvd.nist.gov/vuln/detail/CVE-2023-44389 ADVISORY
- https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a WEB
- https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d WEB
- https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2023-193.yaml WEB
- https://github.com/zopefoundation/Zope PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |