GitHub Advisoryadvisory · PyPI
GHSA-m52m-2qpx-9j4j Zope Object Database (ZODB) Arbitrary files reading and deletion
CRITICAL
Official page ↗
- Aliases
- CVE-2009-2701
- Ecosystem
- PyPI
- Packages
- ZODB3
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Reviewed
- 2024-04-22
Affected packages
• PyPI ZODB3: >= 3.8, < 3.8.3 → fixed in 3.8.3
• PyPI ZODB3: >= 3.9a0, < 3.9.0c2 → fixed in 3.9.0c2
Description
Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.
Related
Alias · CVE (1)
- CVE-2009-2701 Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2009-2701 advisory
- https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-10.yaml web
- https://github.com/zopefoundation/ZODB3 package
- https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html web
- http://pypi.python.org/pypi/ZODB3/3.8.3 web
- http://pypi.python.org/pypi/ZODB3/3.9.0c2 web