Zope does not properly restrict access to the getRoles method
High severity
GitHub Reviewed
Published
Apr 30, 2022
to the GitHub Advisory Database
•
Updated Sep 18, 2023
Description
Published by the National Vulnerability Database
Oct 20, 2000
Published to the GitHub Advisory Database
Apr 30, 2022
Reviewed
Sep 18, 2023
Last updated
Sep 18, 2023
Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.
References