CVE-2023-44389: Zope Management Interface Stored Cross-Site Scripting
Summary
CVE-2023-44389: Zope management interface vulnerable to stored cross site scripting via the title property. Affects zope across 2 version ranges.
>= 4.0.0, < 4.8.11
>= 5.0.0, < 5.8.6
Fixed in 4.8.11 or 5.8.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zope is an open-source web application server written in Python. It provides a platform for building and managing web applications. The Zope Management Interface (ZMI) is a web-based interface that allows users to manage Zope objects. These objects have properties, such as the 'title' property, which can be used to provide additional information about the object. However, a vulnerability in the ZMI allows an attacker to store malicious script code in the 'title' property, which is then executed when the object is viewed in the ZMI.
Vulnerability Detail
The vulnerability arises from the fact that the 'title' property is displayed unquoted in the breadcrumbs element of the ZMI. This allows an attacker to inject script code into the 'title' property, which is then executed when the object is viewed in the ZMI. This can lead to various security issues, including cross-site scripting (XSS) attacks. The vulnerability affects all versions of Zope 4 and Zope 5.
How To Fix
Latest published version: 6.3.0 as of 23 Oct 2026
pip install --upgrade "zope==6.3.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.8.114.8.11pip install --upgrade "zope==4.8.11" -
>= 5.0.0, < 5.8.65.8.6pip install --upgrade "zope==5.8.6"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To mitigate the vulnerability, ensure that only Manager users can edit and view Zope objects in the ZMI. This is the default configuration and helps limit the potential impact of the vulnerability.
Conclusion
The Zope Management Interface is vulnerable to stored cross-site scripting (XSS) attacks due to the unquoted display of the 'title' property in the breadcrumbs element. This can be mitigated by applying the patches released with Zope versions 4.8.11 and 5.8.6 or by ensuring that only Manager users have access to edit and view Zope objects in the ZMI. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for zope →
FAQ
Zope is an open-source web application server written in Python. It provides a platform for building and managing web applications.
The Zope Management Interface (ZMI) is a web-based interface that allows users to manage Zope objects. It provides tools for creating, editing, and organizing objects within a Zope application.
The 'title' property is a common property available on most Zope objects. It is used to provide a human-readable title or label for the object.
The vulnerability allows an attacker to store malicious script code in the 'title' property of Zope objects. When these objects are viewed in the ZMI, the script code is executed, potentially leading to cross-site scripting (XSS) attacks.
To mitigate the vulnerability, ensure that only Manager users can edit and view Zope objects in the ZMI. This restricts access to the vulnerable functionality and reduces the potential impact of the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for zope.
