p PatchFirst

CVE-2023-44389

CVE-2023-44389 · Zope management interface vulnerable to stored cross site scripting via the title property

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.

CVSS 3.1 · Low · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • zope

    Versions
    • >= 4.0.0, < 4.8.11: Affected
    • >= 5.0.0, < 5.8.6: Affected

    No fix published

  • zope PyPI

    Versions
    • 4.0
    • 4.1
    • 4.1.1
    • 4.1.2
    • 4.1.3
    • 4.2
    • 4.2.1
    • 4.3
    • 4.4
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4.4
    • 4.5
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5.4
    • 4.5.5
    • 4.6
    • 4.6.1
    • 4.6.2
    • 4.6.3
    • 4.7
    • 4.8
    • 4.8.1
    • 4.8.10
    • 4.8.2
    • 4.8.3
    • 4.8.4
    • 4.8.5
    • 4.8.6
    • 4.8.7
    • 4.8.8
    • 4.8.9
    Affected ranges
    • ECOSYSTEM: ≥ 4.0.0, < 4.8.11

    Update to 4.8.11

  • zope PyPI

    Versions
    • 5.0
    • 5.1
    • 5.1.1
    • 5.1.2
    • 5.2
    • 5.2.1
    • 5.3
    • 5.4
    • 5.5
    • 5.5.1
    • 5.5.2
    • 5.6
    • 5.7
    • 5.7.1
    • 5.7.2
    • 5.7.3
    • 5.8
    • 5.8.1
    • 5.8.2
    • 5.8.3
    • 5.8.4
    • 5.8.5
    Affected ranges
    • ECOSYSTEM: ≥ 5.0.0, < 5.8.6

    Update to 5.8.6

  • zope PyPI

    Versions
    • 4.0
    • 4.1
    • 4.1.1
    • 4.1.2
    • 4.1.3
    • 4.2
    • 4.2.1
    • 4.3
    • 4.4
    • 4.4.1
    • 4.4.2
    • 4.4.3
    • 4.4.4
    • 4.5
    • 4.5.1
    • 4.5.2
    • 4.5.3
    • 4.5.4
    • 4.5.5
    • 4.6
    • 4.6.1
    • 4.6.2
    • 4.6.3
    • 4.7
    • 4.8
    • 4.8.1
    • 4.8.10
    • 4.8.2
    • 4.8.3
    • 4.8.4
    • 4.8.5
    • 4.8.6
    • 4.8.7
    • 4.8.8
    • 4.8.9
    • 5.0
    • 5.1
    • 5.1.1
    • 5.1.2
    • 5.2
    • 5.2.1
    • 5.3
    • 5.4
    • 5.5
    • 5.5.1
    • 5.5.2
    • 5.6
    • 5.7
    • 5.7.1
    • 5.7.2
    • 5.7.3
    • 5.8
    • 5.8.1
    • 5.8.2
    • 5.8.3
    • 5.8.4
    • 5.8.5
    Affected ranges
    • {"events": [{"introduced": "0"}, {"fixed": "aeaf2cdc80dff60815e3706af448f086ddc3b98d"}, {"fixed": "21dfa78609ffd8b6bd8143805678ebbacae5141a"}], "repo": "https://github.com/zopefoundation/Zope", "type": "GIT"}
    • ECOSYSTEM: ≥ 5.0, < 5.8.6 ∪ ≥ 4.0, < 4.8.11

    Update to 5.8.6; Update to 4.8.11

Original sources

Check your server →