CVE-2023-44389

Advisory

Zope 4.8.11 and 5.8.6 include a fix for CVE-2023-44389: The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected.
https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh

Affected package

Affected versions

Fixed versions

Vulnerability changelog

------------------

- Make sure the object title in the ZMI breadcrumbs is quoted
to prevent a cross-site scripting issue.

- Update to newest compatible versions of dependencies.

- Base the inline/attachment logic developed for CVE-2023-42458
on the media type proper (ignore parameters and
whitespace and normalize to lowercase)
(`1167 <https://github.com/zopefoundation/Zope/pull/1167>`_).

Resources

• https://pypi.org/project/zope
• https://data.safetycli.com/changelogs/zope/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-44389
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh
• https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d
• https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a