Zope management interface vulnerable to stored cross site scripting via the title property
Priority LOW 23CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00481 41st percentileScored 2026-11-07
Fix Fixed Zope (zopefoundation): 4.8.11, 5.8.6Zope (PyPI): 4.8.11, 5.8.6
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zopefoundation | Zope | 4.0.0 to before 4.8.11; 5.0.0 to before 5.8.6 | 4.8.11, 5.8.6 | Patch available | CNA |
| — | Zope (PyPI) | 4.0.0 to before 4.8.11 | 4.8.11 | Patch available | GHSA-m755-gxxg-r5qh |
| — | Zope (PyPI) | 5.0.0 to before 5.8.6 | 5.8.6 | Patch available | GHSA-m755-gxxg-r5qh |
- Zope Vendorzopefoundation Affected 4.0.0 to before 4.8.11; 5.0.0 to before 5.8.6 Fixed in 4.8.11, 5.8.6 Patch available CNA
- Zope (PyPI) Vendor— Affected 4.0.0 to before 4.8.11 Fixed in 4.8.11 Patch available GHSA-m755-gxxg-r5qh
- Zope (PyPI) Vendor— Affected 5.0.0 to before 5.8.6 Fixed in 5.8.6 Patch available GHSA-m755-gxxg-r5qh
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:* | 4.0 to before 4.8.11; 5.0 to before 5.8.6 | Vulnerable | zopefoundation |
- cpe:2.3:a:zope:zope:*:*:*:*:*:*:*:* Versions 4.0 to before 4.8.11; 5.0 to before 5.8.6 Vulnerable ·zopefoundation
Remediation
- Fix · CNA Zope (zopefoundation) Fixed in 4.8.11, 5.8.6
- Fix · GHSA-m755-gxxg-r5qh Zope (PyPI) Fixed in 4.8.11 Advisory →
- Fix · GHSA-m755-gxxg-r5qh Zope (PyPI) Fixed in 5.8.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2023-44389
- 2026-10-03 Alias added: GHSA-m755-gxxg-r5qh
References
Patch 2
Advisory 2
More zopefoundation Zope vulnerabilities
- TI-2011-03162 Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through… CVSS 2.0HIGH 9.3
- TI-2000-00062 The DTML implementation in the Z Object Publishing Environment (Zope) allows remote… CVSS 2.0HIGH 10.0
- TI-2021-12302 Remote Code Execution via traversal in TAL expressions CVSS 3.1HIGH 8.8
- TI-2021-12342 Remote Code Execution via traversal in TAL expressions CVSS 3.1HIGH 8.8
- TI-2005-03148 docutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to… CVSS 2.0HIGH 7.5
- TI-2000-00483 The DocumentTemplate package in Zope 2.2 and earlier allows a remote attacker to modify… CVSS 2.0HIGH 7.5
Sources
- CVE-2023-44389 · CVE Program
- CVE-2023-44389 · NVD
- FIRST EPSS
- GHSA-m755-gxxg-r5qh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences