GitHub Advisoryadvisory · PyPI

GHSA-hm8g-jxjj-gfm3 Zope allows remote attackers to read arbitrary files

MEDIUM Published 2022-05-01 Modified 2024-11-21 Official page ↗
Aliases
CVE-2006-4684
Ecosystem
PyPI
Packages
zope2
Severity
Moderate
Reviewed
2024-11-21

Affected packages

• PyPI zope2: >= 2.7.0, <= 2.7.9 (no fix yet) • PyPI zope2: >= 2.8.0, < 2.8.9 → fixed in 2.8.9

Description

The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText (reST) markup, which allows remote attackers to read arbitrary files via a csv_table directive, a different vulnerability than CVE-2006-3458.

Related

Alias · CVE (1)

  • CVE-2006-4684 The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText… vulnerability

References