CVE-2021-32633: Duplicate Advisory: Path Traversal in Zope

CVE-2021-32633 · Severity: low · CVSS 3.1 · Published 2021-05-21

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

Technologies: Zope (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-32633 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-32633 being exploited in the wild.
How severe is CVE-2021-32633?
Low severity, with a CVSS score of 3.1, published 21 May 2021.
Which products and versions are affected?
Zope (PyPI) ECOSYSTEM:introduced=0,fixed=4.6, GIT:introduced=0,fixed=1f8456bf1f908ea46012537d52bd7e752a532c91|ECOSYSTEM:introduced=0,fixed=4.6,introduced=5.0,fixed=5.2.
Is there a fix for CVE-2021-32633?
Yes. Zope (PyPI): upgrade to 4.6, 5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2021-32633?
Check whether you run Zope (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Zope (PyPI): upgrade to 4.6, 5.2 or later
    pip install "Zope>=5.2"

Affected products

  • Zope (PyPI) ECOSYSTEM:introduced=0,fixed=4.6, GIT:introduced=0,fixed=1f8456bf1f908ea46012537d52bd7e752a532c91|ECOSYSTEM:introduced=0,fixed=4.6,introduced=5.0,fixed=5.2

Identifiers

  • CVE-2021-32633
  • GHSA-5pr9-v234-jw36
  • GHSA-962m-m8jw-8wrr
  • PYSEC-2021-88

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.