Zope allows attackers to modify raw image and file data
Date: 2022-04
Affected: pip/zope
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2000-1212
CWE: CWE-284

Zope 2.2.0 through 2.2.4 does not properly protect a data updating method on Image and File objects, which allows attackers with DTML editing privileges to modify the raw data of these objects.


Mitigations:

Architectural layers (MAESTRO):