CVE-2023-44389
2 advisories.
PyPI/zope CVE-2023-44389: low 3.1, EPSS 0.48%
Zope management interface vulnerable to stored cross site scripting via the title property
Action: Upgrade zope to 4.8.11 or later.
pip install zope==4.8.11pip install zope==5.8.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0.0 | 4.8.11 | - |
| 5.0.0 | 5.8.6 | - |
Fixed versions
| 4.8.11 | 5.8.6 |
Sources
- osv: GHSA-m755-gxxg-r5qh
- https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh
- https://nvd.nist.gov/vuln/detail/CVE-2023-44389
- https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a
- https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d
- https://github.com/pypa/advisory-database/tree/main/vulns/zope/PYSEC-2023-193.yaml
- https://github.com/zopefoundation/Zope
CVE-2023-44389 · published · modified · JSON
PyPI/zope CVE-2023-44389: medium 4.8, EPSS 0.48%
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Manag
Action: Upgrade zope to 4.8.11 or later.
pip install zope==5.8.6pip install zope==4.8.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 4.0 | 4.8.11 | - |
| 5.0 | 5.8.6 | - |
Fixed versions
| 5.8.6 | 4.8.11 |
Sources
- osv: PYSEC-2023-193
- https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh
- https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d
- https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a
CVE-2023-44389 · published · modified · JSON