CVE-2010-1104: Cross-Site Scripting (XSS) Vulnerability in Zope2
Summary
CVE-2010-1104: Moderate severity vulnerability that affects Zope2. Affects zope2 across 5 version ranges.
>= 2.8.0, < 2.8.12
>= 2.9.0, < 2.9.12
>= 2.10.0, < 2.10.11
>= 2.11.0, < 2.11.6
>= 2.12.0, < 2.12.3
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zope2 is a Python web application server that provides a framework for building and managing web applications. It is widely used in the Python ecosystem and offers various features and tools for web development. However, versions 2.8.x through 2.12.x of Zope2 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability allows remote attackers to inject arbitrary web script or HTML through error messages. This can lead to the execution of malicious code in the context of the affected user's browser, potentially compromising the confidentiality and integrity of user data. The vulnerability has a moderate severity rating and is identified by the CVE identifier CVE-2010-1104.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.8.0, < 2.8.122.8.12pip install --upgrade "zope2==2.8.12" -
>= 2.9.0, < 2.9.122.9.12pip install --upgrade "zope2==2.9.12" -
>= 2.10.0, < 2.10.112.10.11pip install --upgrade "zope2==2.10.11" -
>= 2.11.0, < 2.11.62.11.6pip install --upgrade "zope2==2.11.6" -
>= 2.12.0, < 2.12.32.12.3pip install --upgrade "zope2==2.12.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. Upgrading to a fixed version is the recommended solution.
Conclusion
In conclusion, Zope2 versions 2.8.x through 2.12.x are vulnerable to a cross-site scripting (XSS) attack. Users are advised to upgrade to the fixed versions mentioned above to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for zope2 →
FAQ
The vulnerability allows remote attackers to inject malicious code into error messages, potentially leading to cross-site scripting attacks and unauthorized access to user data.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Zope2 installation is affected by this vulnerability. Simply provide your Pipfile.lock and it will analyze your dependencies and alert you if any vulnerabilities are found.
There are no known public exploits for this vulnerability at the time of this report. However, it is important to apply the recommended fix as soon as possible to prevent potential exploitation.
Yes, this vulnerability can be exploited remotely by sending specially crafted requests to the affected Zope2 server.
You can find more details about this vulnerability in the GitHub Advisory Database: [link to the advisory]
Related vulnerabilities
Recent vulnerabilities recorded for zope2.
