Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when
    providing untrusted users with restructured text (reStructuredText) functionality from docutils, which
    allows local users to read arbitrary files. (CVE-2006-3458)

Zope did not deactivate the 'raw' command when exposing RestructuredText functionalities to untrusted users. A remote user with the privilege of editing Zope webpages with RestructuredText could exploit this to expose arbitrary files that can be read with the privileges of the Zope server.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Zope web application server allows read access to arbitrary pages on the server, if a user has the privilege to edit 'restructured text' pages.

Zope team reports :

Unspecified vulnerability in (Zope2) allows local users to obtain sensitive information via unknown attack vectors related to the docutils module and 'restructured text'.

The remote web server is a version of Zope that is older than 2.9.4.  There is a flaw in this version of Zope that may allow attackers to gain access to confidential data.  It is reported that the 'docutils' module does not properly parse user-supplied data.  Successful exploitation leads to loss of confidential data that may be useful in further attacks. 

ID	Name	Product	Family	Type	Severity
432036	SCA: security update for Zope2 (GHSA-jcjp-qqpq-pc54)	Tenable Cloud Security	SCA Checks	Local	medium
432036	SCA: security update for Zope2 (GHSA-jcjp-qqpq-pc54)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
27893	Ubuntu 5.10 : zope2.8 vulnerability (USN-317-1)	Nessus	Ubuntu Local Security Checks	Local	low
22655	Debian DSA-1113-1 : zope2.7 - programming error	Nessus	Debian Local Security Checks	Local	low
22051	FreeBSD : zope -- information disclosure vulnerability (5f2a0c40-1322-11db-bd23-000475abc56f)	Nessus	FreeBSD Local Security Checks	Local	low
3680	Zope < 2.9.4 docutils Information Disclosure	Nessus Network Monitor	Web Servers		medium

Detections

Analytics

CVE-2006-3458

medium

Tenable Plugins

medium

medium

low

low

low

medium