Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2011-4924

Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104

VectorNETWORK

PublishedNov 25, 2019, 18:15

Published Bysecalert@redhat.com

Base Score

Score6.1

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

zope(PyPI)3.1.13.7.3N/A

zope2(PyPI)02.12.22N/A

zope2(PyPI)2.13.0a12.13.12N/A

References

http://www.openwall.com/lists/oss-security/2012/01/19/16
http://www.openwall.com/lists/oss-security/2012/01/19/17
http://www.openwall.com/lists/oss-security/2012/01/19/18
http://www.openwall.com/lists/oss-security/2012/01/19/19
https://access.redhat.com/security/cve/cve-2011-4924
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4924
https://security-tracker.debian.org/tracker/CVE-2011-4924

Weakness Type

CWE-79

CVSS Metrics

Base Score

6.1

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Base SeverityMedium

Version

3.1

Attack Vector (AV)

NETWORK