GHSA-c3rp-4cjh-cp38

Source

https://github.com/advisories/GHSA-c3rp-4cjh-cp38

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-c3rp-4cjh-cp38/GHSA-c3rp-4cjh-cp38.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-c3rp-4cjh-cp38

Aliases

CVE-2002-0170

Published

2022-04-30T18:18:41Z

Modified

2024-02-12T18:12:28.462290Z

Summary

Zope does not properly verify the access for objects with proxy roles

Details

Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.

Database specific

{
    "github_reviewed": true,
    "github_reviewed_at": "2024-02-12T17:57:56Z",
    "severity": "HIGH",
    "nvd_published_at": "2002-04-22T04:00:00Z",
    "cwe_ids": [
        "CWE-284"
    ]
}

References

Affected packages

PyPI / zope

Package

Name: zope; View open source insights on deps.dev
Purl: pkg:pypi/zope

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2.0

Fixed

2.4.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-c3rp-4cjh-cp38/GHSA-c3rp-4cjh-cp38.json"

PyPI / zope

Package

Name: zope; View open source insights on deps.dev
Purl: pkg:pypi/zope

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.5.0

Fixed

2.5.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-c3rp-4cjh-cp38/GHSA-c3rp-4cjh-cp38.json"