vulnwire
7.2high

CVE-2000-0725

Zope does not properly restrict access to the getRoles method

Also known as GHSA-9cmq-pj6p-hgwf, PYSEC-2026-757

Published 26 y ago · modified 4 mo ago · JSON

CVSS
7.2
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 41%
Public exploits
0
none known

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

Exploit prediction (EPSS)

0.47% probability of exploitation in the next 30 days, higher than 41% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected packages

EcosystemPackageAffectedFixed in
pypizope
<2.2.1
2.2.1

Classification

Weakness

References

  • archives.neohapsis.com /archives/bugtraq/2000-08/0259.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • debian.org /security/2000/20000821 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • securityfocus.com /bid/1577 · vdb-entry, x_refsource_BID, x_transferred
  • zope.org /Products/Zope/Hotfix_08_09_2000/security_alert · x_refsource_CONFIRM, x_transferred
  • redhat.com /support/errata/RHSA-2000-052.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • archives.neohapsis.com /archives/bugtraq/2000-08/0198.html · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2000-0725 · advisory
  • web.archive.org /web/20010219192346/http://archives.neohapsis.com/archives/bugtraq/2000-08/0198.html · web
  • web.archive.org /web/20010219192441/http://archives.neohapsis.com/archives/bugtraq/2000-08/0259.html · web
  • web.archive.org /web/20010228172804/http://www.securityfocus.com/bid/1577 · web
  • pypi.org /project/zope · package
  • github.com /advisories/GHSA-9cmq-pj6p-hgwf · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.