Zope Accesscontrol vulnerabilities
3 known vulnerabilities affecting zope/accesscontrol.
Total CVEs
3
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH3
Vulnerabilities
Page 1 of 1
CVE-2021-32811P3HIGHCVSS 7.2≥ 4.0, < 4.3≥ 5.0, < 5.22021-08-02
CVE-2021-32811 [HIGH] CWE-915 CVE-2021-32811: Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a
Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional `Products.PythonScripts` add-on package installed. By defaul
nvd
CVE-2021-32807P3HIGHCVSS 7.2≥ 4.0, < 4.3≥ 5.0, < 5.22021-07-30
CVE-2021-32807 [HIGH] CWE-915 CVE-2021-32807: The module `AccessControl` defines security policies for Python code used in restricted code within
The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. The policies defined in `AccessControl` severely restrict access to Python modules and only exempt a few that are de
nvd
CVE-2023-41050P3HIGHCVSS 7.7fixed in 4.4≥ 5.0, < 5.8+1 more2023-09-06
CVE-2023-41050 [HIGH] CWE-200 CVE-2023-41050: AccessControl provides a general security framework for use in Zope. Python's "format" functionality
AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the p
nvd