Detections
Analytics

SCA: security update for Zope (GHSA-rpcg-f9q6-2mq6)

high Tenable Cloud Security Plugin ID 418844

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Zope is an open-source web application server. This advisory extends the previous advisory at
 https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of
 TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL
 expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids
 file system access, for example via the 'os' module. But some of the untrusted modules are available
 indirectly through Python modules that are available for direct use. By default, you need to have the
 Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to
 add/edit Zope Page Templates through the web are at risk. The problem has been fixed in Zope 5.2.1 and
 4.6.1. The workaround is the same as for
 https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can
 restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission
 mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page
 Templates through the web should be restricted to trusted users only. (CVE-2021-32674)

Solution

Update the Zope library and its related packages to version 4.6.1 or later.

See Also

https://github.com/advisories/GHSA-rpcg-f9q6-2mq6

Plugin Details

Severity: High

ID: 418844

Version: Revision 1.7

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2021-32674

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.3

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/8/2021

Vulnerability Publication Date: 6/8/2021

Reference Information

CVE: CVE-2021-32674

cwe: CWE-22