What’s Vulnerable › Vulnerabilities

CVE-2023-44389: Zope management interface vulnerable to stored cross site scripting via the title property

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-10-04 · updated 2026-06-17
• Weakness: CWE-79

Description

Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.

Affected products

• zopefoundation Zope: from 4.0 before 4.8.11; from 5.0 before 5.8.6 — fixed in 4.8.11, 5.8.6

How to fix

Upgrade to a fixed version: zopefoundation Zope 4.8.11, 5.8.6. Check the vendor advisory for mitigations.

References

• https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a
• https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh
• https://github.com/zopefoundation/Zope/commit/21dfa78609ffd8b6bd8143805678ebbacae5141a
• https://github.com/zopefoundation/Zope/commit/aeaf2cdc80dff60815e3706af448f086ddc3b98d
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh

Get alerted when CVE-2023-44389 or the next vulnerability affects your stack