Skip to content

Path Traversal in Zope

High severity GitHub Reviewed Published Jun 10, 2021 to the GitHub Advisory Database • Updated Feb 1, 2023

Package

pip Zope (pip)

Affected versions

< 4.6.1
>= 5.0, < 5.2.1

Patched versions

4.6.1
5.2.1

Description

Zope is an open-source web application server. This advisory extends the previous advisory at GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use. By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk. The problem has been fixed in Zope 5.2.1 and 4.6.1. The workaround is the same as for GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

References

Published by the National Vulnerability Database Jun 8, 2021
Reviewed Jun 9, 2021
Published to the GitHub Advisory Database Jun 10, 2021
Last updated Feb 1, 2023

Severity

High
8.8
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE ID

CVE-2021-32674

GHSA ID

GHSA-5vq5-pg3r-9ph3

Source code

Loading Checking history
See something to contribute? Suggest improvements for this vulnerability.