Medium severity · published Nov 25, 2019
CVE-2011-4924
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through…
6.1
CVSS
1.4%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZO
Zope · Zope
2.8.0 before 2.8.12; 2.9.0 before 2.9.12; 2.10.0 before 2.10.11; 2.11.0 before 2.11.6; 2.12.0 before 2.12.3; 3.1.1 through 3.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-4924
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-4924
Mailing List
http://www.openwall.com/lists/oss-security/2012/01/19/16
Mailing List
http://www.openwall.com/lists/oss-security/2012/01/19/17
Mailing List
http://www.openwall.com/lists/oss-security/2012/01/19/18
Mailing List
http://www.openwall.com/lists/oss-security/2012/01/19/19
Third Party Advisory
https://access.redhat.com/security/cve/cve-2011-4924
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4924
More from Zope
8.8
CVE-2021-32674
Zope is an open-source web application server
8.8
CVE-2021-32633
Zope is an open-source web application server
7.7
CVE-2023-41050
AccessControl provides a general security framework for use in Zope
7.2
CVE-2021-32811
Zope is an open-source web application server
6.1
CVE-2021-33507
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS