vulnwire
7.5high

CVE-2002-0688

ZCatalog plug-in for Zope allows anonymous users to bypass access restrictions

Also known as GHSA-7944-h5rw-qmjx, PYSEC-2026-755

Published 24 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.4%
percentile 73%
Public exploits
0
none known

ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes.

Exploit prediction (EPSS)

1.44% probability of exploitation in the next 30 days, higher than 73% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

EcosystemPackageAffectedFixed in
pypizope
>=2.4.0, <2.6.0
2.6.0

References

  • debian.org /security/2004/dsa-490 · vendor-advisory, x_refsource_DEBIAN, x_transferred
  • iss.net /security_center/static/9610.php · vdb-entry, x_refsource_XF, x_transferred
  • redhat.com /support/errata/RHSA-2002-060.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • securityfocus.com /bid/5812 · vdb-entry, x_refsource_BID, x_transferred
  • zope.org /Products/Zope/Hotfix_2002-06-14/security_alert · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2002-0688 · advisory
  • web.archive.org /web/20020810160608/http://www.zope.org/Products/Zope/Hotfix_2002-06-14/security_alert · web
  • web.archive.org /web/20020822025750/http://www.iss.net/security_center/static/9610.php · web
  • web.archive.org /web/20021206023914/http://rhn.redhat.com/errata/RHSA-2002-060.html · web
  • web.archive.org /web/20021223212650/http://online.securityfocus.com/bid/5812 · web
  • web.archive.org /web/20070430090648/http://www.debian.org/security/2004/dsa-490 · web
  • pypi.org /project/zope · package
  • github.com /advisories/GHSA-7944-h5rw-qmjx · advisory

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.