CVE-2006-4684 Zope allows remote attackers to read arbitrary files
Remote attackers can read arbitrary files on Zope servers via a crafted reStructuredText csv_table directive, exposing sensitive data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-4684?
CVE-2006-4684 is a medium-severity path traversal vulnerability in n/a, published on 19 Sep 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText (reST) markup, which allows remote attackers to read arbitrary files via a csv_table directive, a different vulnerability than CVE-2006-3458.
Which versions are affected by CVE-2006-4684?
4 open source packages ship an affected version, including zope2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
zope2 PyPI | From 2.7.0 to 2.7.9 | None |
zope2 PyPI | From 2.7.0 to 2.7.9 | None |
zope2 PyPI | From 2.8.0 | 2.8.9 |
zope2 PyPI | From 2.8.0 | 2.8.9 |
Products include Zope Zope.
How do I fix CVE-2006-4684?
Upgrade zope2 to 2.8.9 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2006-4684 being exploited?
There is no known exploitation of CVE-2006-4684 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2000-0062 Zope DTML implementation Improper Authentication
- CVE-2021-32674 Remote Code Execution via traversal in TAL expressions
- CVE-2000-1211 Zope does not properly perform security registration for legacy names
- CVE-2002-0170 Zope does not properly verify the access for objects with proxy roles
- CVE-2002-0688 ZCatalog plug-in for Zope allows anonymous users to bypass access restrictions
Sources
Also known as DSA-1176-1, GHSA-hm8g-jxjj-gfm3.