Zope allows local users to read arbitrary files
Low severity
GitHub Reviewed
Published
May 1, 2022
to the GitHub Advisory Database
•
Updated Nov 21, 2024
Package
Affected versions
>= 2.7.0, < 2.7.8
>= 2.8.0, < 2.8.7
>= 2.9.0, < 2.9.3
Patched versions
2.7.8
2.8.7
2.9.3
Description
Published by the National Vulnerability Database
Jul 7, 2006
Published to the GitHub Advisory Database
May 1, 2022
Reviewed
Nov 21, 2024
Last updated
Nov 21, 2024
Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.
References