Information disclosure in Zope Accesscontrol
CVE-2023-41050
AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. `AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe. Affected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (48.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 49th percentile — 48.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.005 · newest: 0.006 · change: +0.001
Affected products
- Zope Accesscontrol
- Zope
- Zopefoundation Accesscontrol — versions AccessControl: < 4.4, AccessControl: >= 5.0, < 5.8, AccessControl: >= 6.0, < 6.2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2023-41050?
- CVE-2023-41050 is a medium-severity vulnerability in Zope Accesscontrol, classified under Information Disclosure. CVSS score: 6.8/10. Published 2023-09-06.
- How severe is CVE-2023-41050?
- Medium severity. CVSS v3 base score is 6.8 out of 10.