CVE-2011-3587: Zope Command Execution Vulnerability in zope2
Summary
CVE-2011-3587: Zope Command Execution Vulnerability. Affects zope2 across 2 version ranges.
>= 2.12.0, < 2.12.20
>= 2.13.0, < 2.13.10
Fixed in 2.12.20 or 2.13.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Zope is an open-source web application server and framework primarily used for building dynamic web applications in Python. The zope2 package is a core component of the Zope application server, providing essential functionalities for web development. This package is widely utilized in various content management systems, including Plone. The vulnerability in question affects versions 2.12.x and 2.13.x of Zope, which are integrated into Plone versions 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, making it critical for users of these versions to address the issue promptly.
Vulnerability Detail
The vulnerability allows remote attackers to execute arbitrary commands on the server through specific vectors related to the p_ class in OFS/misc_.py and the use of Python modules. This could lead to unauthorized access, data breaches, or complete system compromise, depending on the attacker's intent and capabilities. The flaw is particularly concerning as it does not require authentication, making it easier for malicious actors to exploit it.
How To Fix
Latest published version: 4.0.0 as of 23 Oct 2026
pip install --upgrade "zope2==4.0.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.12.0, < 2.12.202.12.20pip install --upgrade "zope2==2.12.20" -
>= 2.13.0, < 2.13.102.13.10pip install --upgrade "zope2==2.13.10"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, consider restricting access to the affected components or implementing firewall rules to limit exposure to the vulnerable endpoints. Additionally, review and sanitize any user inputs that may interact with the vulnerable classes to mitigate potential exploitation.
Conclusion
The CVE-2011-3587 vulnerability in the Zope web application server poses significant risks, allowing remote command execution. It is crucial for users of affected versions to upgrade to the patched versions promptly to mitigate these risks. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for zope2 →
FAQ
CVE-2011-3587 is a security vulnerability in the Zope web application server that allows remote command execution.
The vulnerability affects Zope versions 2.12.x and 2.13.x, specifically when used in Plone versions 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Failing to address this vulnerability could lead to unauthorized command execution, data breaches, and potential full system compromise.
Yes, Vulert monitors and alerts for open-source vulnerabilities in your software using just the Pipfile.lock, providing real-time insights.
References
Related vulnerabilities
Recent vulnerabilities recorded for zope2.
