Zope does not properly verify the access for objects with proxy roles
High severity
GitHub Reviewed
Published
Apr 30, 2022
to the GitHub Advisory Database
•
Updated Feb 12, 2024
Package
Affected versions
>= 2.2.0, < 2.4.4
>= 2.5.0, < 2.5.1
Patched versions
2.4.4
2.5.1
Description
Published by the National Vulnerability Database
Apr 22, 2002
Published to the GitHub Advisory Database
Apr 30, 2022
Reviewed
Feb 12, 2024
Last updated
Feb 12, 2024
Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.
References