Description

Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.

Remediation

References

CVE-2006-3458

Related Vulnerabilities

e107 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2016-10378)

Oracle Database Server CVE-2023-21949 Vulnerability (CVE-2023-21949)

IBM RTC Improper Restriction of Rendered UI Layers or Frames Vulnerability (CVE-2020-4547)

WordPress Plugin Ajax Contact Form Cross-Site Scripting (1.0)

MySQL Other Vulnerability (CVE-2005-2558)

Severity

Low

Classification

CVE-2006-3458

Tags

Missing Update Known Vulnerabilities