p PatchFirst

CVE-2021-32633

CVE-2021-32633 · Remote Code Execution via traversal in TAL expressions

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

CVSS 6.8 · Medium · EPSS 1.9% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • zope

    Versions
    • < 4.6: Affected
    • >= 5.0, < 5.2: Affected

    No fix published

  • zope PyPI

    Versions
    • 4.0
    • 4.0b1
    • 4.0b10
    • 4.0b2
    • 4.0b3
    • 4.0b4
    • 4.0b5
    • 4.0b6
    • 4.0b7
    • 4.0b8
    • 4.0b9
    • 4.1
    • 4.1.1
    • 4.1.2
    • 4.1.3
    • 4.2
    • 4.2.1
    • 4.3
    • 4.4
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4.4
    • 4.5
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5.4
    • 4.5.5
    Affected ranges
    • ECOSYSTEM: < 4.6

    Update to 4.6

  • zope PyPI

    Versions
    • 5.0
    • 5.1
    • 5.1.1
    • 5.1.2
    Affected ranges
    • ECOSYSTEM: ≥ 5.0, < 5.2

    Update to 5.2

  • zope PyPI

    Versions
    • 4.0
    • 4.0b1
    • 4.0b10
    • 4.0b2
    • 4.0b3
    • 4.0b4
    • 4.0b5
    • 4.0b6
    • 4.0b7
    • 4.0b8
    • 4.0b9
    • 4.1
    • 4.1.1
    • 4.1.2
    • 4.1.3
    • 4.2
    • 4.2.1
    • 4.3
    • 4.4
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4.4
    • 4.5
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5.4
    • 4.5.5
    • 5.0
    • 5.1
    • 5.1.1
    • 5.1.2
    Affected ranges
    • GIT: < 1f8456bf1f908ea46012537d52bd7e752a532c91
    • ECOSYSTEM: < 4.6 ∪ ≥ 5.0, < 5.2

    Update to 4.6; Update to 5.2

Original sources

Check your server →