Description

Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.

Remediation

References

CVE-2023-44389

Related Vulnerabilities

Dolibarr Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-19998)

Plone CMS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2012-5497)

Moodle Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-4284)

Joomla Other Vulnerability (CVE-2006-4474)

WordPress Ultimate Member Plugin CVE-2020-36170 Vulnerability (CVE-2020-36170)

Severity

Medium

Classification

CVE-2023-44389 CWE-707 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities