Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104

Affected Packages

PyPI zope

Affected versions: 3.1.1 (fixed in 3.7.3)

PyPI zope2

Affected versions: 0 (fixed in 2.12.22)

PyPI zope2

Affected versions: 2.13.0a1 (fixed in 2.13.12)

Related CVEs

CVE-2011-4924

Key Information

GHSA ID

GHSA-vh6g-786f-hxxp

Published

April 22, 2022 12:24 AM

Last Modified

January 15, 2024 5:29 PM

CVSS Score

5.0 /10

Primary Ecosystem

PyPI

Primary Package

zope

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 16, 2025 6:27 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.