CVE-2009-0669

Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.

Published Bycve@mitre.org

Published DateAug 07, 2009, 19:30

Affected Versions(1)

ZODB3(PyPI)

Introduced0

Fixed3.8.2

LimitN/A

Package (Ecosystem)	Introduced	Fixed	Limit
ZODB3(PyPI)	0	3.8.2	N/A

Weakness Type (CWE):CWE-287

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL

References

http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html
http://osvdb.org/56826
http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2
http://secunia.com/advisories/36204
http://secunia.com/advisories/36205
http://www.securityfocus.com/bid/35987
http://www.vupen.com/english/advisories/2009/2217
https://exchange.xforce.ibmcloud.com/vulnerabilities/52379

Weakness Type (CWE):CWE-287

CVSS Metrics

Base Score

7.5

Vector String

AV:N/AC:L/Au:N/C:P/I:P/A:P

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

PARTIAL

Integrity (I)

PARTIAL

Availability (A)

PARTIAL