CVE-2000-1211

Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities.

CVSS v2.0 7.5 HIGH

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.iss.net/security_center/static/5824.php
http://www.linux-mandrake.com/en/security/2000/MDKSA-2000-083.php3	Patch Vendor Advisory
http://www.osvdb.org/6282
http://www.redhat.com/support/errata/RHSA-2000-125.html
http://www.zope.org/Products/Zope/Hotfix_2000-12-08/security_alert	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zope:zope:2.2.0:::::::*
	cpe:2.3:a:zope:zope:2.2.0a1:::::::*
	cpe:2.3:a:zope:zope:2.2.0b1:::::::*
	cpe:2.3:a:zope:zope:2.2.0b2:::::::*
	cpe:2.3:a:zope:zope:2.2.0b3:::::::*
	cpe:2.3:a:zope:zope:2.2.0b4:::::::*
	cpe:2.3:a:zope:zope:2.2.1:::::::*
	cpe:2.3:a:zope:zope:2.2.1b1:::::::*
	cpe:2.3:a:zope:zope:2.2.2:::::::*
	cpe:2.3:a:zope:zope:2.2.3:::::::*
	cpe:2.3:a:zope:zope:2.2.4:::::::*

History

No history.

Information

Published : 2000-12-16 05:00

Updated : 2008-09-05 20:22

NVD link : CVE-2000-1211

Mitre link : CVE-2000-1211

CVE.ORG link : CVE-2000-1211

JSON object : View

Products Affected

zope

zope

CWE

NVD-CWE-Other

{"id": "CVE-2000-1211", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": false}]}, "published": "2000-12-16T05:00:00.000", "references": [{"url": "http://www.iss.net/security_center/static/5824.php", "source": "cve@mitre.org"}, {"url": "http://www.linux-mandrake.com/en/security/2000/MDKSA-2000-083.php3", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/6282", "source": "cve@mitre.org"}, {"url": "http://www.redhat.com/support/errata/RHSA-2000-125.html", "source": "cve@mitre.org"}, {"url": "http://www.zope.org/Products/Zope/Hotfix_2000-12-08/security_alert", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities."}], "lastModified": "2008-09-05T20:22:55.870", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zope:zope:2.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF3C0DAC-01B0-4C9D-9AA2-8F02F974DCFF"}, {"criteria": "cpe:2.3:a:zope:zope:2.2.0a1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D4E13A0-7384-49E3-A848-8E864C340F79"}, {"criteria": "cpe:2.3:a:zope:zope:2.2.0b1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0EA5CE15-530A-400D-9FDF-7044CD8C6DDC"}, {"criteria": "cpe:2.3:a:zope:zope:2.2.0b2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7DC30CD-684E-4C53-833E-6EF2C8D1A3E3"}, {"criteria": "cpe:2.3:a:zope:zope:2.2.0b3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DABDC050-BF8B-4F8C-9FCD-4B0D86E46D60"}, {"criteria": "cpe:2.3:a:zope:zope:2.2.0b4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C91E72CC-8AEA-49E5-BB7D-3C16E2E30A0D"}, {"criteria": "cpe:2.3:a:zope:zope:2.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12A13ABF-9850-4AB8-A0C9-8D6B9F3D9862"}, {"criteria": "cpe:2.3:a:zope:zope:2.2.1b1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98EBD292-5FC6-4463-B085-A34D1DFDB0C3"}, {"criteria": "cpe:2.3:a:zope:zope:2.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15B80335-5F59-4530-A241-437367369BD8"}, {"criteria": "cpe:2.3:a:zope:zope:2.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "53427D40-495B-4F37-95A5-6D069186CBB5"}, {"criteria": "cpe:2.3:a:zope:zope:2.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1DB2FC39-A95D-414E-A67E-66AF79A12CEB"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}