# PYSEC-2017-148 - Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.

Source: https://junglewise.ai/threats/pysec-2017-148-cross-site-scripting-xss-vulnerability-in-zmi-pages-that-6369fd2d  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-08-07  
License: CC BY 4.0 with a link back

Severity: low · CVSS 3 · Published 2017-08-07

Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.

Technologies: [Zope (PyPI)](https://junglewise.ai/threats/technologies/zope). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Low severity, with a CVSS score of 3, published 7 August 2017.

**Which products and versions are affected?** Zope (PyPI) GIT:introduced=0,fixed=2abdf14620f146857dc8e3ffd2b6a754884c331d|ECOSYSTEM:introduced=0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected?** Check whether you run Zope (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Zope (PyPI) GIT:introduced=0,fixed=2abdf14620f146857dc8e3ffd2b6a754884c331d|ECOSYSTEM:introduced=0

## Related threats

- [PYSEC-2026-2326 - Access control vulnerable to user data deletion by anonynmous users](https://junglewise.ai/threats/cve-2024-51734-access-control-vulnerable-to-user-data-deletion-by-anonynmous)
- [PYSEC-2026-2325 - Information disclosure in AccessControl](https://junglewise.ai/threats/cve-2023-41050-information-disclosure-in-accesscontrol)
- [PYSEC-2026-2077 - Zope vulnerable to Stored Cross Site Scripting with SVG images](https://junglewise.ai/threats/cve-2023-42458-zope-vulnerable-to-stored-cross-site-scripting-with-svg-images)
- [PYSEC-2026-760 - Zope DocumentTemplate package allows unauthenticated write](https://junglewise.ai/threats/cve-2000-0483-zope-documenttemplate-package-allows-unauthenticated-write)
- [PYSEC-2026-761 - Zope Server vulnerable to DoS via header injection](https://junglewise.ai/threats/cve-2002-0687-zope-server-vulnerable-to-dos-via-header-injection)