TI-2023-22623 Aliases CVE-2023-42458 GHSA-wm8q-9975-xh5v

Zope vulnerable to Stored Cross Site Scripting with SVG images

LOW 26CWE-79Published 2023-09-21 · Updated 2025-02-13

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in Zope 4.8.10 and 5.8.5. As a workaround, make sure the "Add Documents, Images, and Files" permission is only assigned to trusted roles. By default, only the Manager has this permission.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00714 53rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Zope (zopefoundation): 4.8.10, 5.8.5Zope (PyPI): 4.8.10, 5.8.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
zopefoundation	Zope	before 4.8.10; 5.0.0 to before 5.8.5	4.8.10, 5.8.5	Patch available	CNA
—	Zope (PyPI)	before 4.8.10	4.8.10	Patch available	GHSA-wm8q-9975-xh5v
—	Zope (PyPI)	5.8.0 to before 5.8.5	5.8.5	Patch available	GHSA-wm8q-9975-xh5v

Zope Vendorzopefoundation Affected before 4.8.10; 5.0.0 to before 5.8.5 Fixed in 4.8.10, 5.8.5 Patch available CNA
Zope (PyPI) Vendor— Affected before 4.8.10 Fixed in 4.8.10 Patch available GHSA-wm8q-9975-xh5v
Zope (PyPI) Vendor— Affected 5.8.0 to before 5.8.5 Fixed in 5.8.5 Patch available GHSA-wm8q-9975-xh5v

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zope:zope::::::::	before 4.8.10; 5.0.0 to before 5.8.5	Vulnerable	zopefoundation

cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:* Versions before 4.8.10; 5.0.0 to before 5.8.5 Vulnerable ·zopefoundation

Remediation

Fix · CNA Zope (zopefoundation) Fixed in 4.8.10, 5.8.5
Fix · GHSA-wm8q-9975-xh5v Zope (PyPI) Fixed in 4.8.10 Advisory →
Fix · GHSA-wm8q-9975-xh5v Zope (PyPI) Fixed in 5.8.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-42458
2026-10-03 Alias added: GHSA-wm8q-9975-xh5v

References

Exploit 1

http://www.openwall.com/lists/oss-security/2023/09/22/2

Patch 2

Advisory 2

Other 1

https://github.com/zopefoundation/Zope

TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
TI-2000-00062 The DTML implementation in the Z Object Publishing Environment (Zope) allows remote… CVSS 2.0HIGH 10.0
TI-2021-12302 Remote Code Execution via traversal in TAL expressions CVSS 3.1HIGH 8.8
TI-2021-12342 Remote Code Execution via traversal in TAL expressions CVSS 3.1HIGH 8.8
TI-2005-03148 docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to… CVSS 2.0HIGH 7.5
TI-2000-00483 The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify… CVSS 2.0HIGH 7.5

See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences