MEDIUM

GHSA-7whr-j8vf-r4wj

Zope allows attackers to modify raw image and file data

Details

Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / zope

Introduced in: 2.2.0

No fixed version published yet for zope (pip). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2000-1212 [ADVISORY]
https://exchange.xforce.ibmcloud.com/vulnerabilities/5778 [WEB]
https://web.archive.org/web/20020117134418/http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000365 [WEB]
http://www.debian.org/security/2001/dsa-007 [WEB]
http://www.redhat.com/support/errata/RHSA-2000-135.html [WEB]
http://www.zope.org/Products/Zope/Hotfix_2000-12-18/security_alert [WEB]