Unscored severity · published Sep 8, 2009
CVE-2009-2701
Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain…
–
CVSS
1%
EPSS
No
On KEV
Description
Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZO
Zodb · Zope
3.8; 3.8.0; 3.8.1; 3.8.2; 3.9.0; 3.9.0b1; +5 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2701
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2701
Patch
http://pypi.python.org/pypi/ZODB3/3.8.3
Patch
http://pypi.python.org/pypi/ZODB3/3.9.0c2
Patch
http://www.vupen.com/english/advisories/2009/2534
Patch
https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html
More from Zodb
–
CVE-2010-3495
Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then…
–
CVE-2009-0669
Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors…
–
CVE-2009-0668
Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to execute…