GitHub Advisoryadvisory · PyPI

GHSA-9cmq-pj6p-hgwf Zope does not properly restrict access to the getRoles method

HIGH Published 2022-04-30 Modified 2023-09-18 Official page ↗
Aliases
CVE-2000-0725
Ecosystem
PyPI
Packages
zope
Severity
High
Weaknesses
CWE-284
Reviewed
2023-09-18

Affected packages

• PyPI zope: < 2.2.1 → fixed in 2.2.1

Description

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

Related

Alias · CVE (1)

  • CVE-2000-0725 Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by… vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References