GHSA-m755-gxxg-r5qh: Zope management interface vulnerable to stored cross site scripting via the title property

Skip to content

• • Actions

    Automate any workflow

  • Packages

    Host and manage packages

  • Security

    Find and fix vulnerabilities

  • Codespaces

    Instant dev environments

  • Copilot

    Write better code with AI

  • Code review

    Manage code changes

  • Issues

    Plan and track work

  • Discussions

    Collaborate outside of code

• • GitHub Sponsors

    Fund open source developers

*   The ReadME Project
    
    GitHub community articles

• Pricing

1. GitHub Advisory Database
2. GitHub Reviewed
3. GHSA-m755-gxxg-r5qh

Zope management interface vulnerable to stored cross site scripting via the title property

Low severity GitHub Reviewed Published Oct 4, 2023 in zopefoundation/Zope • Updated Oct 4, 2023

Affected versions

< 4.8.11

>= 5.0.0, < 5.8.6

Patched versions

4.8.11

5.8.6

Description

Impact

The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI) because the title property is displayed unquoted in the breadcrumbs element. All versions of Zope 4 and Zope 5 are affected.

Patches

Patches will be released with Zope versions 4.8.11 and 5.8.6

Workarounds

Make sure only Manager users can edit and view Zope objects in the Zope Management Interface. This is the default.

References

• GHSA-m755-gxxg-r5qh
• zopefoundation/Zope@21dfa78
• zopefoundation/Zope@aeaf2cd

Published to the GitHub Advisory Database

Oct 4, 2023