GitHub Advisoryadvisory · PyPI

GHSA-vh6g-786f-hxxp Zope XSS Vulnerability

MEDIUM Published 2022-04-22 Modified 2024-01-15 Official page ↗
Aliases
CVE-2011-4924
Ecosystem
PyPI
Packages
zope, zope2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-01-15

Affected packages

• PyPI zope: >= 3.1.1, < 3.7.3 → fixed in 3.7.3 • PyPI zope2: < 2.12.22 → fixed in 2.12.22 • PyPI zope2: >= 2.13.0a1, < 2.13.12 → fixed in 2.13.12

Description

Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104

Related

Alias · CVE (1)

  • CVE-2011-4924 Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References