Description
Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | zope | >= 2.2.0, <= 2.2.4 | — | GHSA-7whr-j8vf-r4wj |
References
- MDKSA-2000:086 vendor-advisory
- http://www.zope.org/Products/Zope/Hotfix_2000-12-18/security_alert
- DSA-007 vendor-advisory
- RHSA-2000:135 vendor-advisory
- zope-image-file(5778) vdb-entry
- 6283 vdb-entry
- CLA-2000:365 vendor-advisory