CVE-2023-41050: Information Disclosure Vulnerability in Zope Package
Summary
CVE-2023-41050: Information disclosure in AccessControl. Affects zope across 2 version ranges.
< 4.8.9
>= 5.0.0, < 5.8.4
Fixed in 4.8.9 or 5.8.4, depending on the release line you run. How to fix ↓
Also tracked for
- accesscontrol · PyPI
- accesscontrol · PyPI
The same CVE-2023-41050 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zope is an open-source web application server and framework for building dynamic web applications in Python. It provides a robust environment for developing web applications with features such as object publishing, security, and session management. However, Zope is vulnerable to an information disclosure issue that arises from its 'format' functionality, which can be exploited by untrusted users to access sensitive data.
Vulnerability Detail
The vulnerability originates from Python's 'format' functionality, which allows a format string controlled by an attacker to access objects recursively via attribute access and subscription. This is done using Python's standard 'getattr' and 'getitem' methods instead of the restricted variants provided by AccessControl. As a result, sensitive information can be disclosed to unauthorized users, particularly affecting systems where untrusted users can execute AccessControl controlled Python code.
How To Fix
Latest published version: 6.3.0 as of 23 Oct 2026
pip install --upgrade "zope==6.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.8.94.8.9pip install --upgrade "zope==4.8.9" -
>= 5.0.0, < 5.8.45.8.4pip install --upgrade "zope==5.8.4"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. The only effective solution is to update to the patched versions.
Conclusion
CVE-2023-41050 is a significant vulnerability in the Zope package that can lead to information disclosure. Users are urged to update to the latest patched versions to mitigate the risk. Regular monitoring of open-source vulnerabilities using tools like Vulert is recommended to maintain application security.
See every vulnerability recorded for zope →
FAQ
CVE-2023-41050 is a vulnerability in the Zope package that allows information disclosure through unsafe format string handling.
All users of the Zope package who allow untrusted users to create and execute AccessControl controlled Python code are affected.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application's status using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 6.8, indicating a medium severity level.
No, there are currently no workarounds available. The only solution is to update to the patched versions of the Zope package.
References
Related vulnerabilities
Recent vulnerabilities recorded for zope.
