← Vulnerability feed

Vulnerability record · CVE-2002-0688 · published 23 July 2002

CVE-2002-0688: Zope vulnerability

Zope · Zope

ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes.

7.5 CVSS 2.0 High EPSS 1.4% · top 27.9%
7.5CVSS 2.0 base score
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
10References
16 Jun 2026Last modified by NVD

Description

ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes.

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.debian.org/security/2004/dsa-490
http://www.iss.net/security_center/static/9610.php
http://www.redhat.com/support/errata/RHSA-2002-060.html
http://www.securityfocus.com/bid/5812
http://www.zope.org/Products/Zope/Hotfix_2002-06-14/security_alert PatchVendor Advisory
http://www.debian.org/security/2004/dsa-490
http://www.iss.net/security_center/static/9610.php
http://www.redhat.com/support/errata/RHSA-2002-060.html
http://www.securityfocus.com/bid/5812
http://www.zope.org/Products/Zope/Hotfix_2002-06-14/security_alert PatchVendor Advisory

Track CVE-2002-0688 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2000-0062Zope vulnerabilityThe DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.EPSS 2.2%9.3CVE-2011-3587Zope p_ class remote command execution in PloneZope 2.12.x and 2.13.x, as shipped in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, contains an unspecified flaw tied to the p_ class in OFS…EPSS 78%analysed8.8CVE-2021-32674Zope path traversal vulnerabilityZope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisor…EPSS 1.6%8.8CVE-2021-32633Plone path traversal vulnerabilityZope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python mo…EPSS 1.9%7.7CVE-2023-41050Zope accesscontrol information exposure vulnerabilityAccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to …EPSS 0.64%7.5CVE-2011-2528Plone hotfix 20110720 vulnerabilityUnspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix201…EPSS 2.0%7.5CVE-2005-3323Zope vulnerabilitydocutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in Restructure…EPSS 3.0%7.5CVE-2002-0170Zope vulnerabilityZope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violat…EPSS 1.6%

Source: NIST National Vulnerability Database (record CVE-2002-0688), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.