ZCatalog plug-in for Zope allows anonymous users to bypass access restrictions
High severity
GitHub Reviewed
Published
Apr 30, 2022
to the GitHub Advisory Database
•
Updated Feb 12, 2024
Description
Published by the National Vulnerability Database
Jul 23, 2002
Published to the GitHub Advisory Database
Apr 30, 2022
Reviewed
Feb 12, 2024
Last updated
Feb 12, 2024
ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes.
References