vulnwire
5.0med

CVE-2002-0687

Zope Server vulnerable to DoS via header injection

Also known as GHSA-vwrc-g9q6-f675, PYSEC-2026-761

Published 24 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.5%
percentile 74%
Public exploits
0
none known

The "through the web code" capability for Zope 2.0 through 2.5.1 b1 allows untrusted users to shut down the Zope server via certain headers.

Exploit prediction (EPSS)

1.48% probability of exploitation in the next 30 days, higher than 74% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:N/I:N/A:P

Affected packages

EcosystemPackageAffectedFixed in
pypizope
>=2.0.0, <2.4.4b2
>=2.5.0, <2.5.1b2
2.4.4b2
2.5.1b2

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

  • securityfocus.com /bid/5813 · vdb-entry, x_refsource_BID, x_transferred
  • redhat.com /support/errata/RHSA-2002-060.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • osvdb.org /5166 · vdb-entry, x_refsource_OSVDB, x_transferred
  • iss.net /security_center/static/9621.php · vdb-entry, x_refsource_XF, x_transferred
  • zope.org /Products/Zope/Hotfix_2002-04-15/security_alert · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2002-0687 · advisory
  • marc.info /?l=zope-announce&m=101890177815066&w=2 · web
  • marc.info /?l=zope-announce&m=101897461507941&w=2 · web
  • marc.info /?l=zope-announce&m=101897462107967&w=2 · web
  • web.archive.org /web/20020822024423/http://www.iss.net/security_center/static/9621.php · web
  • web.archive.org /web/20021018100409/http://online.securityfocus.com/bid/5813 · web
  • pypi.org /project/zope · package
  • github.com /advisories/GHSA-vwrc-g9q6-f675 · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.