Zope Multiple Vulnerabilities

Bugtraq ID:	9400
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jan 12 2004 12:00AM
Updated:	Jan 12 2004 12:00AM
Credit:	The disclosure of these issues has been credited to the vendor.
Vulnerable:	Zope Zope 2.7 .0 BETA3 Zope Zope 2.7 .0 BETA2 Zope Zope 2.7 .0 BETA1 Zope Zope 2.6.2 Zope Zope 2.6.1
Not Vulnerable:	Zope Zope 2.7 .0 BETA4 Zope Zope 2.6.3

Zope Multiple Vulnerabilities

Multiple vulnerabilities have been reported to exist in the software that may allow an attacker to carry out attacks resulting from improper input validation, access validation, information disclosure, and various improper security checks on a vulnerable system. Successful exploitation of these issues may lead to cross-site scripting attacks, denial of service conditions, and other attacks.

These issues have been reported to exist in Zope versions 2.6.2 and prior and development releases 2.7.0 beta3. Other versions could be affected as well.

Zope Multiple Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Zope Multiple Vulnerabilities

Solution:
The vendor has released Zope versions 2.6.3 and 2.7.0 beta 4 to address these issues. Users are strongly advised to upgrade to the fixed versions.


Zope Zope 2.6.1

• Zope Zope 2.6.3
  http://www.zope.org/Products/Zope/2.6.3/

Zope Zope 2.6.2

• Zope Zope 2.6.3
  http://www.zope.org/Products/Zope/2.6.3/

Zope Zope 2.7 .0 BETA2

• Zope Zope 2.7.0 BETA4
  http://www.zope.org/Products/Zope/2.7.0b4/

Zope Zope 2.7 .0 BETA3

• Zope Zope 2.7.0 BETA4
  http://www.zope.org/Products/Zope/2.7.0b4/

Zope Zope 2.7 .0 BETA1

• Zope Zope 2.7.0 BETA4
  http://www.zope.org/Products/Zope/2.7.0b4/

Zope Multiple Vulnerabilities

References:

• Welcome to Zope.org (Zope)
  
• Zope 2.6.3 Release and Security Update (Zope)
  
• Zope 2.7.0 beta 4 Release and Security Update (Zope)