CVE-2021-32811

{
  "id": "CVE-2021-32811",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.6
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "zopefoundation",
          "product": "Zope",
          "versions": [
            {
              "status": "affected",
              "version": ">= 4.0, < 4.6.3"
            },
            {
              "status": "affected",
              "version": ">= 5.0, < 5.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-08-02T22:15:08.333",
  "references": [
    {
      "url": "https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zopefoundation/Zope/commit/f72a18dda8e9bf2aedb46168761668464a4be988",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j8fr",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/zopefoundation/Zope/commit/f72a18dda8e9bf2aedb46168761668464a4be988",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j8fr",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-915"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional `Products.PythonScripts` add-on package installed. By default, one must have the admin-level Zope \"Manager\" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. Zope releases 4.6.3 and 5.3 are not vulnerable. As a workaround, a site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope."
    },
    {
      "lang": "es",
      "value": "Zope es un servidor de aplicaciones web de código abierto. Zope versiones anteriores a 4.6.3 y 5.3 tienen un problema de seguridad de ejecución de código remota . Para ser afectado, uno debe usar Python 3 para su despliegue de Zope, ejecutar Zope 4 por debajo de la versión 4.6.3 o Zope 5 por debajo de la versión 5.3, y tener el paquete adicional opcional \"Products.PythonScripts\" instalado. Por defecto, hay que tener el rol de \"Manager\" de Zope a nivel de administrador para añadir o editar objetos Script (Python) mediante la web. Sólo los sitios que permiten a usuarios no confiables añadir/editar estos scripts mediante la web están en riesgo. Zope versiones 4.6.3 y 5.3 no son vulnerables. Como solución, el administrador del sitio puede restringir la adición/edición de objetos Script (Python) mediante la web usando los mecanismos estándar de permisos de usuario/rol de Zope. Los usuarios que no son de confianza no se les debería asignar el rol de Administrador de Zope y añadir/editar estos scripts mediante la web debería estar restringido sólo a usuarios de confianza. Esta es la configuración predeterminada en Zope"
    }
  ],
  "lastModified": "2026-06-17T03:53:40.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zope:accesscontrol:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8538D35C-EA69-4A87-8DBB-D6522F8C7422",
              "versionEndExcluding": "4.3",
              "versionStartIncluding": "4.0"
            },
            {
              "criteria": "cpe:2.3:a:zope:accesscontrol:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34F2C931-DCB6-4326-BBDF-2E9B13946D55",
              "versionEndExcluding": "5.2",
              "versionStartIncluding": "5.0"
            },
            {
              "criteria": "cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30CF6645-50E3-42F0-8E21-8476237210C8",
              "versionEndExcluding": "4.6.3",
              "versionStartIncluding": "4.0"
            },
            {
              "criteria": "cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63A55EE7-7617-407F-83AB-219EA3769E61",
              "versionEndExcluding": "5.3",
              "versionStartIncluding": "5.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}