CVE-2002-0688 ZCatalog plug-in for Zope allows anonymous users to bypass access restrictions
Anonymous users can bypass access restrictions in Zope catalog indexes to call arbitrary methods, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2002-0688?
CVE-2002-0688 is a high-severity missing authorization vulnerability in n/a, published on 2 Apr 2003. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ZCatalog plug-in index support capability for Zope 2.4.0 through 2.5.1 allows anonymous users and untrusted code to bypass access restrictions and call arbitrary methods of catalog indexes.
Which versions are affected by CVE-2002-0688?
3 open source packages ship an affected version, including zope. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
zope PyPI | From 2.4.0 | 2.6.0 |
zope PyPI | From 2.4.0 | 2.6.0 |
zope PyPI | From 2.4.0 | 2.6.0 |
Products include Zope Zope.
How do I fix CVE-2002-0688?
Upgrade zope to 2.6.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2002-0688 being exploited?
There is no known exploitation of CVE-2002-0688 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2000-0062 Zope DTML implementation Improper Authentication
- CVE-2021-32674 Remote Code Execution via traversal in TAL expressions
- CVE-2000-1211 Zope does not properly perform security registration for legacy names
- CVE-2002-0170 Zope does not properly verify the access for objects with proxy roles
- CVE-2001-1227 Security feature bypass in n/a
Sources
Also known as DSA-490, GHSA-7944-h5rw-qmjx, PYSEC-2026-755.