CVE-2021-32633

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites...

CVE-2021-32633 Remote Code Execution via traversal in TAL expressions

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites...

CVE-2021-32633

CVE-2021-32633 affects Zope prior to versions 4.6 and 5.2, where untrusted modules can indirectly access Python modules available for direct use, enabling unauthenticated or low-privileged users who can edit Zope Page Templates to exploit web-exposed templates. The issue arises from how Zope hand...