CVE-2009-5145 Zope Cross-site scripting (XSS) vulnerability in ZMI pages
Cross-site scripting in Zope ZMI pages allows attackers to inject scripts, potentially leading to session hijacking or malicious actions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2009-5145?
CVE-2009-5145 is a medium-severity cross-site scripting vulnerability in n/a, published on 7 Aug 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage_tabs_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6, 2.10.5, 2.10.4, 2.10.2, 2.10.1, 2.12.
Weakness: CWE-79
Which versions are affected by CVE-2009-5145?
3 open source packages ship an affected version, including zope2 and Zope2. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
zope2 PyPI | All versions | 2.12.5 |
zope2 PyPI | All versions | 2.12.5 |
Zope2 PyPI | All versions | 2.12.5 |
Products include Zope Zope.
How do I fix CVE-2009-5145?
Upgrade zope2 to 2.12.5 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2009-5145 being exploited?
There is no known exploitation of CVE-2009-5145 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2000-0062 Zope DTML implementation Improper Authentication
- CVE-2021-32674 Remote Code Execution via traversal in TAL expressions
- CVE-2000-1211 Zope does not properly perform security registration for legacy names
- CVE-2002-0170 Zope does not properly verify the access for objects with proxy roles
- CVE-2002-0688 ZCatalog plug-in for Zope allows anonymous users to bypass access restrictions
Sources
Also known as GHSA-5r4x-qc7q-vj27, PYSEC-2026-763.