Media

Information disclosure in AccessControl

Publicada: 07.09.2023
Actualizado: 11.10.2026 14:18

Impact

Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown getattr and getitem, not the policy restricted AccessControl variants _getattr_ and _getitem_. This can lead to critical information disclosure.

AccessControl already provides a safe variant for str.format and denies access to string.Formatter. However, str.format_map is still unsafe.

Affected are all users who allow untrusted users to create AccessControl controlled Python code and execute it.

Patches

A fix will be introduced in the versions 4.4, 5.8 and 6.2.

Workarounds

There are no workarounds.

References

https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-xjw2-6jm9-rf67 describes the corresponding problem for RestrictedPython.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Python (PyPI)	accesscontrol	< 4.4, >= 5.0, < 5.8, >= 6.0, < 6.2	4.4, 5.8, 6.2
Python (PyPI)	zope	< 4.8.9, >= 5.0.0, < 5.8.4	4.8.9, 5.8.4

Referencias

Puntuación CVSS 6.8/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Debilidad (CWE): CWE-200
Plataforma: Python (PyPI)
Paquete: accesscontrol, zope
Publicada: 07.09.2023
Actualizado: 11.10.2026 14:18

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2026-2075 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-8xv7-89vj-q48c - CC BY 4.0

OSV / GitHub Advisory Database - PYSEC-2026-2325 - PyPA Advisory Database; CC BY 4.0

Historial de vulnerabilidades: zope

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (17) en el archivo

Entradas en total: 17
Primera → última: 05.2021 11.2024
Sin corrección: 4
Explotada en ataques: 0

Distribución por gravedad

Crítica 1
Alta 8
Media 6
Baja 2

Divulgaciones por año

2021: 4
2022: 9
2023: 3
2024: 1
2025: 0
2026: 0

04.11.2024

Access control vulnerable to user data deletion by anonynmous users

Crítica · 9.1 CVE-2024-51734 < 5.11.1 5.11.1
07.09.2023

Information disclosure in AccessControl esta entrada

Media · 6.8 CVE-2023-41050 < 4.8.9, >= 5.0.0, < 5.8.4 4.8.9, 5.8.4
30.04.2022

ZCatalog plug-in for Zope allows anonymous users to bypass access restrictions

Alta CVE-2002-0688 >= 2.4.0, < 2.6.0 2.6.0
30.04.2022

Zope does not properly verify the access for objects with proxy roles

Alta CVE-2002-0170 >= 2.2.0, < 2.4.4, >= 2.5.0, < 2.5.1 2.4.4, 2.5.1
30.04.2022

Zope does not properly perform security registration for legacy names

Alta CVE-2000-1211 >= 2.2.0, <= 2.2.4 sin corrección
30.04.2022

Zope does not properly restrict access to the getRoles method

Alta CVE-2000-0725 < 2.2.1 2.2.1
30.04.2022

Zope DTML implementation Improper Authentication

Alta CVE-2000-0062 >= 2.2.0, <= 2.2.4 sin corrección
02.08.2021

Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope

Alta · 7.5 CVE-2021-32811 >= 4.0, < 4.6.3, >= 5.0, < 5.3 4.6.3, 5.3
08.06.2021

Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TA

Alta · 8.8 CVE-2021-32674 >= 4.0, < 4.6.1, >= 5.0, < 5.2.1 4.6.1, 5.2.1
21.05.2021

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default

Alta · 8.8 CVE-2021-32633 < 4.6, >= 5.0, < 5.2 4.6, 5.2

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación