Description

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

Remediation

References

CVE-2000-0725

Related Vulnerabilities

MySQL CVE-2024-21247 Vulnerability (CVE-2024-21247)

Jenkins Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Vulnerability (CVE-2018-1000193)

WordPress Plugin GD Star Rating 'export.php' Security Bypass (1.9.18)

WordPress Plugin Polldaddy Polls & Ratings Unspecified Vulnerability (2.0.25)

SharePoint CVE-2020-1499 Vulnerability (CVE-2020-1499)

Severity

High

Tags

Missing Update Known Vulnerabilities CVE-2000-0725