Read the docs
TI-2010-03057 Aliases CVE-2010-3198GHSA-qh4q-fwf8-qqrw

ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to…

Priority LOW 23CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

ZServer in Zope 2.10.x before 2.10.12 and 2.11.x before 2.11.7 allows remote attackers to cause a denial of service (crash of worker threads) via vectors that trigger uncaught exceptions.

Why it matters now

EPSS 0.01541 75th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Zope (PyPI): 2.10.12, 2.11.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—Zope (PyPI)2.10.0 to before 2.10.122.10.12Patch availableGHSA-qh4q-fwf8-qqrw
—Zope (PyPI)2.11.0 to before 2.11.72.11.7Patch availableGHSA-qh4q-fwf8-qqrw
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • Zope (PyPI) Vendor— Affected 2.10.0 to before 2.10.12 Fixed in 2.10.12 Patch available GHSA-qh4q-fwf8-qqrw
  • Zope (PyPI) Vendor— Affected 2.11.0 to before 2.11.7 Fixed in 2.11.7 Patch available GHSA-qh4q-fwf8-qqrw

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:zope:zope:2.10.0-b1:*:*:*:*:*:*:*2.10.0-b1Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.0-b2:*:*:*:*:*:*:*2.10.0-b2Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.0-c1:*:*:*:*:*:*:*2.10.0-c1Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.0-final:*:*:*:*:*:*:*2.10.0-finalVulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.2:*:*:*:*:*:*:*2.10.2Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.2-b1:*:*:*:*:*:*:*2.10.2-b1Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.2-final:*:*:*:*:*:*:*2.10.2-finalVulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.3:*:*:*:*:*:*:*2.10.3Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.3-final:*:*:*:*:*:*:*2.10.3-finalVulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.4-final:*:*:*:*:*:*:*2.10.4-finalVulnerablezopefoundation
  • cpe:2.3:a:zope:zope:2.10.0-b1:*:*:*:*:*:*:* Versions 2.10.0-b1 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.0-b2:*:*:*:*:*:*:* Versions 2.10.0-b2 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.0-c1:*:*:*:*:*:*:* Versions 2.10.0-c1 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.0-final:*:*:*:*:*:*:* Versions 2.10.0-final Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.2:*:*:*:*:*:*:* Versions 2.10.2 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.2-b1:*:*:*:*:*:*:* Versions 2.10.2-b1 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.2-final:*:*:*:*:*:*:* Versions 2.10.2-final Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.3:*:*:*:*:*:*:* Versions 2.10.3 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.3-final:*:*:*:*:*:*:* Versions 2.10.3-final Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.4-final:*:*:*:*:*:*:* Versions 2.10.4-final Vulnerable ·zopefoundation
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zope:zope:2.10.5:*:*:*:*:*:*:*2.10.5Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.6:*:*:*:*:*:*:*2.10.6Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.7:*:*:*:*:*:*:*2.10.7Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.8:*:*:*:*:*:*:*2.10.8Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.9:*:*:*:*:*:*:*2.10.9Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.10:*:*:*:*:*:*:*2.10.10Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.10.11:*:*:*:*:*:*:*2.10.11Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.11.0:*:*:*:*:*:*:*2.11.0Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.11.0a1:*:*:*:*:*:*:*2.11.0a1Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.11.0b1:*:*:*:*:*:*:*2.11.0b1Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.11.0c1:*:*:*:*:*:*:*2.11.0c1Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.11.1:*:*:*:*:*:*:*2.11.1Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.11.2:*:*:*:*:*:*:*2.11.2Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.11.3:*:*:*:*:*:*:*2.11.3Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.11.4:*:*:*:*:*:*:*2.11.4Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.11.5:*:*:*:*:*:*:*2.11.5Vulnerablezopefoundation
cpe:2.3:a:zope:zope:2.11.6:*:*:*:*:*:*:*2.11.6Vulnerablezopefoundation
  • cpe:2.3:a:zope:zope:2.10.5:*:*:*:*:*:*:* Versions 2.10.5 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.6:*:*:*:*:*:*:* Versions 2.10.6 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.7:*:*:*:*:*:*:* Versions 2.10.7 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.8:*:*:*:*:*:*:* Versions 2.10.8 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.9:*:*:*:*:*:*:* Versions 2.10.9 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.10:*:*:*:*:*:*:* Versions 2.10.10 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.10.11:*:*:*:*:*:*:* Versions 2.10.11 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.11.0:*:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.11.0a1:*:*:*:*:*:*:* Versions 2.11.0a1 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.11.0b1:*:*:*:*:*:*:* Versions 2.11.0b1 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.11.0c1:*:*:*:*:*:*:* Versions 2.11.0c1 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.11.1:*:*:*:*:*:*:* Versions 2.11.1 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.11.2:*:*:*:*:*:*:* Versions 2.11.2 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.11.3:*:*:*:*:*:*:* Versions 2.11.3 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.11.4:*:*:*:*:*:*:* Versions 2.11.4 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.11.5:*:*:*:*:*:*:* Versions 2.11.5 Vulnerable ·zopefoundation
  • cpe:2.3:a:zope:zope:2.11.6:*:*:*:*:*:*:* Versions 2.11.6 Vulnerable ·zopefoundation

Remediation

  • Fix · GHSA-qh4q-fwf8-qqrw Zope (PyPI) Fixed in 2.10.12 Advisory →
  • Fix · GHSA-qh4q-fwf8-qqrw Zope (PyPI) Fixed in 2.11.7 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-3198
  2. 2026-10-03 Alias added: GHSA-qh4q-fwf8-qqrw

References

Exploit 1

Patch 1

Advisory 2

Other 8

  • TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
  • TI-2000-00062 The DTML implementation in the Z Object Publishing Environment (Zope) allows remote… CVSS 2.0HIGH 10.0
  • TI-2021-12302 Remote Code Execution via traversal in TAL expressions CVSS 3.1HIGH 8.8
  • TI-2021-12342 Remote Code Execution via traversal in TAL expressions CVSS 3.1HIGH 8.8
  • TI-2005-03148 docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2000-00483 The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify… CVSS 2.0HIGH 7.5
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences