Description

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

Remediation

References

CVE-2000-0725

Related Vulnerabilities

Jetty Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2017-7658)

WordPress Plugin Share Drafts Publicly Information Disclosure (1.1.4)

Python Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2007-4559)

Artifactory Insufficient Verification of Data Authenticity Vulnerability (CVE-2018-19971)

Moodle Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2025-67847)

Severity

High

Classification

CVE-2000-0725

Tags

Missing Update Known Vulnerabilities