vulnwire
7.5high

CVE-2002-0170

Zope does not properly verify the access for objects with proxy roles

Also known as GHSA-c3rp-4cjh-cp38, PYSEC-2026-758

Published 24 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known

Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.

Exploit prediction (EPSS)

1.58% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

EcosystemPackageAffectedFixed in
pypizope
>=2.2.0, <2.4.4
>=2.5.0, <2.5.1
2.4.4
2.5.1

Classification

Weakness

References

  • marc.info /?l=bugtraq&m=101503023511996&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • zope.org /Products/Zope/hotfixes/ · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/4229 · vdb-entry, x_refsource_BID, x_transferred
  • redhat.com /support/errata/RHSA-2002-060.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • iss.net /security_center/static/8334.php · vdb-entry, x_refsource_XF, x_transferred
  • osvdb.org /5350 · vdb-entry, x_refsource_OSVDB, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2002-0170 · advisory
  • github.com /zopefoundation/Zope · package
  • launchpad.net /zope2/+milestone/2.4.4 · web
  • launchpad.net /zope2/+milestone/2.5.1 · web
  • web.archive.org /web/20021120034302/http://online.securityfocus.com/bid/4229 · web
  • web.archive.org /web/20070914020022/http://xforce.iss.net/xforce/xfdb/8334 · web
  • pypi.org /project/zope · package
  • github.com /advisories/GHSA-c3rp-4cjh-cp38 · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.