Medium severity · published Oct 4, 2023
CVE-2023-44389
Zope is an open-source web application server
4.8
CVSS
0.5%
EPSS
No
On KEV
Description
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZO
Zope · Zope
4.0 before 4.8.11; 5.0 before 5.8.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-44389
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-44389
Patch
https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a
Patch
https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d
Vendor Advisory
https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh
More from Zope
8.8
CVE-2021-32674
Zope is an open-source web application server
8.8
CVE-2021-32633
Zope is an open-source web application server
7.7
CVE-2023-41050
AccessControl provides a general security framework for use in Zope
7.2
CVE-2021-32811
Zope is an open-source web application server
6.1
CVE-2021-33507
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS