Unscored severity · published Aug 7, 2009
CVE-2009-0669
Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors…
–
CVSS
2.9%
EPSS
No
On KEV
Description
Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.9% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZO
Zodb · Zope
through 3.8.1; 3.8; 3.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-0669
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-0669
mail.zope.org
http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html
osvdb.org
http://osvdb.org/56826
Patch
http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2
Vendor Advisory
http://secunia.com/advisories/36204
Vendor Advisory
http://secunia.com/advisories/36205
www.securityfocus.com
http://www.securityfocus.com/bid/35987
More from Zodb
–
CVE-2010-3495
Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then…
–
CVE-2009-2701
Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain…
–
CVE-2009-0668
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute…