Zope management interface vulnerable to stored cross site scripting via the title property (zopefoundation Zope)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.48 % · percentile 41 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- GitHub_M
- NVD status
- Modified
Description
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
Weaknesses (CWE)
- CWE-79 — Improper Neutralization of Input During Web Page Generation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 3.1 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N | GitHub_M |
| CVSS 3.1 | LOW 3.1 | CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N | NVD · security-advisories@github.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.8 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-m755-gxxg-r5qh — Zope management interface vulnerable to stored cross site scripting via the title property
- PYSEC-2023-193 — Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewi
European references
- ENISA EUVD · EUVD-2023-0286
- GCVE · GCVE-0-2023-44389
CERT-FR advisories
- CERTFR-2025-AVI-0896 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:*≥ 4.0 < 4.8.11cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:*≥ 5.0 < 5.8.6
Affected products
| Product | Versions |
|---|---|
| zopefoundation · Zope | affected >= 4.0.0, < 4.8.11 ; affected >= 5.0.0, < 5.8.6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |