← Vulnerability feed

Vulnerability record · CVE-2023-41050 · published 6 September 2023

CVE-2023-41050: Zope accesscontrol information exposure vulnerability

Zope · Accesscontrol

AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. `AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe. Affected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

7.7 CVSS 3.1 High EPSS 0.64% · top 51.4% CWE-200 · Information exposure
7.7CVSS 3.1 base score
0.64%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. `AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe. Affected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/zopefoundation/AccessControl/commit/6bc32692e0d4b8d5cf64eae3d19de987c7375bc9 Patch
https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-8xv7-89vj-q48c Vendor Advisory
https://github.com/zopefoundation/AccessControl/commit/6bc32692e0d4b8d5cf64eae3d19de987c7375bc9 Patch
https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-8xv7-89vj-q48c Vendor Advisory

Track CVE-2023-41050 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2000-0062Zope vulnerabilityThe DTML implementation in the Z Object Publishing Environment (Zope) allows remote attackers to conduct unauthorized activities.EPSS 2.2%9.3CVE-2011-3587Zope p_ class remote command execution in PloneZope 2.12.x and 2.13.x, as shipped in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, contains an unspecified flaw tied to the p_ class in OFS…EPSS 78%analysed8.8CVE-2021-32674Zope path traversal vulnerabilityZope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisor…EPSS 1.6%8.8CVE-2021-32633Plone path traversal vulnerabilityZope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python mo…EPSS 1.9%7.5CVE-2011-2528Plone hotfix 20110720 vulnerabilityUnspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix201…EPSS 2.0%7.5CVE-2005-3323Zope vulnerabilitydocutils in Zope 2.6, 2.7 before 2.7.8, and 2.8 before 2.8.2 allows remote attackers to include arbitrary files via include directives in Restructure…EPSS 3.0%7.5CVE-2002-0688Zope vulnerabilityZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and ca…EPSS 1.4%7.5CVE-2002-0170Zope vulnerabilityZope 2.2.0 through 2.5.1 does not properly verify the access for objects with proxy roles, which could allow some users to access documents in violat…EPSS 1.6%

Source: NIST National Vulnerability Database (record CVE-2023-41050), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.