Multiple vulnerabilities in Zope

Published: 2016-10-18 | Updated: 2025-06-17

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2002-0170 CVE-2001-1227
CWE-ID	CWE-20
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Zope Web applications / Other software
Vendor	Zope

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU111192

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2002-0170

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Zope: 2.2.0 - 2.5.1b1

CPE2.3

External links

https://marc.info/?l=bugtraq&m=101503023511996&w=2
https://www.iss.net/security_center/static/8334.php
https://www.osvdb.org/5350
https://www.redhat.com/support/errata/RHSA-2002-060.html
https://www.securityfocus.com/bid/4229
https://www.zope.org/Products/Zope/hotfixes/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Input validation error

EUVDB-ID: #VU111194