CVE-2010-1104
Summary
| CVE | CVE-2010-1104 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2010-03-25 17:30:00 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3 allows remote attackers to inject arbitrary web script or HTML via vectors related to error messages. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Zope | Zope | 2.10.0-b1 | All | All | All |
| Application | Zope | Zope | 2.10.0-b2 | All | All | All |
| Application | Zope | Zope | 2.10.0-c1 | All | All | All |
| Application | Zope | Zope | 2.10.0-final | All | All | All |
| Application | Zope | Zope | 2.10.10 | All | All | All |
| Application | Zope | Zope | 2.10.11 | All | All | All |
| Application | Zope | Zope | 2.10.2 | All | All | All |
| Application | Zope | Zope | 2.10.2-b1 | All | All | All |
| Application | Zope | Zope | 2.10.2-final | All | All | All |
| Application | Zope | Zope | 2.10.3 | All | All | All |
| Application | Zope | Zope | 2.10.3-final | All | All | All |
| Application | Zope | Zope | 2.10.4-final | All | All | All |
| Application | Zope | Zope | 2.10.5 | All | All | All |
| Application | Zope | Zope | 2.10.6 | All | All | All |
| Application | Zope | Zope | 2.10.7 | All | All | All |
| Application | Zope | Zope | 2.10.8 | All | All | All |
| Application | Zope | Zope | 2.10.9 | All | All | All |
| Application | Zope | Zope | 2.11.0 | All | All | All |
| Application | Zope | Zope | 2.11.0a1 | All | All | All |
| Application | Zope | Zope | 2.11.0b1 | All | All | All |
| Application | Zope | Zope | 2.11.0c1 | All | All | All |
| Application | Zope | Zope | 2.11.1 | All | All | All |
| Application | Zope | Zope | 2.11.2 | All | All | All |
| Application | Zope | Zope | 2.11.3 | All | All | All |
| Application | Zope | Zope | 2.11.4 | All | All | All |
| Application | Zope | Zope | 2.11.5 | All | All | All |
| Application | Zope | Zope | 2.12.0 | All | All | All |
| Application | Zope | Zope | 2.12.1 | All | All | All |
| Application | Zope | Zope | 2.12.2 | All | All | All |
| Application | Zope | Zope | 2.8 | All | All | All |
| Application | Zope | Zope | 2.8.0 | All | All | All |
| Application | Zope | Zope | 2.8.0-a1 | All | All | All |
| Application | Zope | Zope | 2.8.0-a2 | All | All | All |
| Application | Zope | Zope | 2.8.0-b1 | All | All | All |
| Application | Zope | Zope | 2.8.0-b2 | All | All | All |
| Application | Zope | Zope | 2.8.0-final | All | All | All |
| Application | Zope | Zope | 2.8.1 | All | All | All |
| Application | Zope | Zope | 2.8.1-b1 | All | All | All |
| Application | Zope | Zope | 2.8.1-final | All | All | All |
| Application | Zope | Zope | 2.8.10 | All | All | All |
| Application | Zope | Zope | 2.8.11 | All | All | All |
| Application | Zope | Zope | 2.8.2 | All | All | All |
| Application | Zope | Zope | 2.8.3 | All | All | All |
| Application | Zope | Zope | 2.8.4 | All | All | All |
| Application | Zope | Zope | 2.8.5 | All | All | All |
| Application | Zope | Zope | 2.8.6 | All | All | All |
| Application | Zope | Zope | 2.8.7 | All | All | All |
| Application | Zope | Zope | 2.8.8 | All | All | All |
| Application | Zope | Zope | 2.8.9 | All | All | All |
| Application | Zope | Zope | 2.8.9.1 | All | All | All |
| Application | Zope | Zope | 2.9.0 | All | All | All |
| Application | Zope | Zope | 2.9.0-b1 | All | All | All |
| Application | Zope | Zope | 2.9.0-b2 | All | All | All |
| Application | Zope | Zope | 2.9.1 | All | All | All |
| Application | Zope | Zope | 2.9.10 | All | All | All |
| Application | Zope | Zope | 2.9.11 | All | All | All |
| Application | Zope | Zope | 2.9.2 | All | All | All |
| Application | Zope | Zope | 2.9.3 | All | All | All |
| Application | Zope | Zope | 2.9.4 | All | All | All |
| Application | Zope | Zope | 2.9.5 | All | All | All |
| Application | Zope | Zope | 2.9.6 | All | All | All |
| Application | Zope | Zope | 2.9.7 | All | All | All |
| Application | Zope | Zope | 2.9.8 | All | All | All |
| Application | Zope | Zope | 2.9.9 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Zope 'standard_error_message' Cross-Site Scripting Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| [Zope-Annce] New Zope2 releases available | af854a3a-2127-422b-91ae-364da2661108 | mail.zope.org | Patch, Vendor Advisory |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| www.osvdb.org/61655 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| Zope "standard_error_message" Cross-Site Scripting Vulnerability - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2010-04-21 | Vincent Danen | Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2010-1104 The Red Hat Security Response Team has rated this issue as having moderate security impact, a future update may address this flaw. |
Legacy QID Mappings
- 980847 Python (pip) Security Update for Zope2 (GHSA-v7q8-wvvh-c97p)