CVE-2023-44389CWE-79

Zope management interface vulnerable to stored cross site scripting via the title property

Low · published October 4, 2023

CVSS v3.1
3.1
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00481 · 40.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-10-04T20:07Z
EPSS history
Timeline
  • 04 OCT 20:07Z
    Zope management interface vulnerable to stored cross site scripting via the title property
    cvelistv5