← Vulnerability feed

Vulnerability record · CVE-2002-0170 · published 22 April 2002

CVE-2002-0170: Zope vulnerability

Zope · Zope

Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.

7.5 CVSS 2.0 High EPSS 1.6% · top 25.4%
7.5CVSS 2.0 base score
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
12References
16 Jun 2026Last modified by NVD

Description

Zope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violation of the intended configuration.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://marc.info/?l=bugtraq&m=101503023511996&w=2
http://www.iss.net/security_center/static/8334.php
http://www.osvdb.org/5350
http://www.redhat.com/support/errata/RHSA-2002-060.html
http://www.securityfocus.com/bid/4229
http://www.zope.org/Products/Zope/hotfixes/ PatchVendor Advisory
http://marc.info/?l=bugtraq&m=101503023511996&w=2
http://www.iss.net/security_center/static/8334.php
http://www.osvdb.org/5350
http://www.redhat.com/support/errata/RHSA-2002-060.html
http://www.securityfocus.com/bid/4229
http://www.zope.org/Products/Zope/hotfixes/ PatchVendor Advisory

Track CVE-2002-0170 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2000-0062Zope vulnerabilityThe DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.EPSS 2.2%9.3CVE-2011-3587Zope p_ class remote command execution in PloneZope 2.12.x and 2.13.x, as shipped in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, contains an unspecified flaw tied to the p_ class in OFS…EPSS 78%analysed8.8CVE-2021-32674Zope path traversal vulnerabilityZope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisor…EPSS 1.6%8.8CVE-2021-32633Plone path traversal vulnerabilityZope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python mo…EPSS 1.9%7.7CVE-2023-41050Zope accesscontrol information exposure vulnerabilityAccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to …EPSS 0.64%7.5CVE-2011-2528Plone hotfix 20110720 vulnerabilityUnspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix201…EPSS 2.0%7.5CVE-2005-3323Zope vulnerabilitydocutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in Restructure…EPSS 3.0%7.5CVE-2002-0688Zope vulnerabilityZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and ca…EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2002-0170), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.