Zope does not properly perform security registration for legacy names
Date: 2022-04
Affected: pip/zope
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2000-1211
CWE: CWE-287

Zope 2.2.0 through 2.2.4 does not properly perform security registration for legacy names of object constructors such as DTML method objects, which could allow attackers to perform unauthorized activities.


Mitigations:

Architectural layers (MAESTRO):