Input validation error in Zope - CVE-2010-3198
Published: September 10, 2010 / Updated: June 17, 2025
Vulnerability identifier: #VU111184
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2010-3198
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Zope
Affected software:
Zope
Zope
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to perform service disruption.
ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service (crash of worker threads) via vectors that trigger uncaught exceptions.
How to mitigate CVE-2010-3198
Install update from vendor's website.
Sources
- http://www.securityfocus.com/bid/42939
- http://www.vupen.com/english/advisories/2010/2275
- http://www.zope.org/Products/Zope/2.10.12/CHANGES.txt
- http://www.zope.org/Products/Zope/2.11.7/CHANGES.txt
- https://bugs.launchpad.net/zope2/+bug/627988
- https://mail.zope.org/pipermail/zope-announce/2010-September/002247.html