PYSEC-2021-368

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/zope/PYSEC-2021-368.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2021-368
Aliases
Published
2021-08-02T22:15:00Z
Modified
2026-07-09T16:56:40Z
Summary
[none]
Details

Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional Products.PythonScripts add-on package installed. By default, one must have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. Zope releases 4.6.3 and 5.3 are not vulnerable. As a workaround, a site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.

References

Affected packages

PyPI / zope

Package

Name
zope
View open source insights on deps.dev
Purl
pkg:pypi/zope

Affected ranges

Type
GIT
Repo
https://github.com/zopefoundation/Zope
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f72a18dda8e9bf2aedb46168761668464a4be988
Type
ECOSYSTEM
Events
Introduced
4.0
Fixed
4.6.3
Introduced
5.0
Fixed
5.3

Affected versions

4.*
4.0a1
4.0a2
4.0a3
4.0a4
4.0a5
4.0a6
4.0b1
4.0b2
4.0b3
4.0b4
4.0b5
4.0b6
4.0b7
4.0b8
4.0b9
4.0b10
4.0
4.1
4.1.1
4.1.2
4.1.3
4.2
4.2.1
4.3
4.4
4.4.1
4.4.2
4.4.3
4.4.4
4.5
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.6
4.6.1
4.6.2
5.*
5.0a1
5.0a2
5.0
5.1
5.1.1
5.1.2
5.2
5.2.1

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/zope/PYSEC-2021-368.yaml"