# zope2 (PyPI) vulnerabilities 11 known vulnerabilities, with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.0.0 (May 10, 2019): no advisory affects it - Newest unaffected release: 4.0.0 (May 10, 2019), the latest release - Weekly downloads: 5,310 - Dependents: 99 - Releases: 83 since 2.12.0 (Sep 30, 2009) - Registry: https://pypi.org/project/zope2/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2011-4924: 2.12.0a1 to 2.12.21 (2.12.22 is outside it); 2.13.0a1 to 2.13.11 (2.13.12 is outside it) - CVE-2009-5145: 2.12.0a1 to 2.12.4 (2.12.5 is outside it) - CVE-2012-6661: 2.12.0a1 to 2.13.18 (2.13.19 is outside it) - CVE-2012-5507: 2.12.0a1 to 2.13.18 (2.13.19 is outside it) - CVE-2012-5489: 2.12.0a1 to 2.12.20 (2.12.21 is outside it); 2.13.0 to 2.13.10 (2.13.11 is outside it) - CVE-2012-5486: 2.12.0a1 to 2.13.18 (2.13.19 is outside it) - CVE-2011-3587: 2.12.0 to 2.12.19 (2.12.20 is outside it); 2.13.0 to 2.13.9 (2.13.10 is outside it) - CVE-2011-2528: 2.12.0 to 2.12.18 (2.12.19 is outside it); 2.13.0 to 2.13.7 (2.13.8 is outside it) - CVE-2010-1104: 2.12.0 to 2.12.2 (2.12.3 is outside it) - CVE-2006-4684: no published release is affected - CVE-2006-3458: no published release is affected ## Advisories (11) ### [CVE-2011-4924](https://cve.now/CVE-2011-4924): Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6… - Severity: Unrated - Published: Nov 25, 2019 - Affected: fixed in 2.12.22; from 2.13.0a1, fixed in 2.13.12; fixed in 2.12.22; from 2.13.0a1, fixed in 2.13.12. - Fixed in 2.12.22 (released Jan 18, 2012, 2868 days before disclosure) and 2.13.12 (released Jan 18, 2012, 2868 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2009-5145](https://cve.now/CVE-2009-5145): Cross-site scripting (XSS) vulnerability in ZMI pages that use the manage\_tabs\_message in Zope 2.11.4, 2.11.2, 2.10.9, 2.10.7, 2.10.6… - Severity: Unrated - Published: Aug 7, 2017 - Affected: fixed in 2.12.5. - Fixed in 2.12.5 (released Apr 24, 2010, 2662 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2012-6661](https://cve.now/CVE-2012-6661): Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, does not reseed the pseudo-random number generator (PRNG), which… - Severity: Unrated - Published: Nov 3, 2014 - Affected: fixed in 2.13.19. - Fixed in 2.13.19 (released Oct 31, 2012, 733 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2012-5507](https://cve.now/CVE-2012-5507): AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to… - Severity: Unrated - Published: Sep 30, 2014 - Affected: fixed in 2.13.19. - Fixed in 2.13.19 (released Oct 31, 2012, 699 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2012-5489](https://cve.now/CVE-2012-5489): The App.Undo.UndoSupport.get\_request\_var\_or\_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3… - Severity: Unrated - Published: Sep 30, 2014 - Affected: fixed in 2.12.21; from 2.13.0, fixed in 2.13.11; fixed in 2.12.21; from 2.13, fixed in 2.13.11. - Fixed in 2.12.21 (released Dec 12, 2011, 1023 days before disclosure) and 2.13.11 (released Dec 12, 2011, 1023 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2012-5486](https://cve.now/CVE-2012-5486): ZPublisher.HTTPRequest.\_scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject… - Severity: Unrated - Published: Sep 30, 2014 - Affected: fixed in 2.13.19. - Fixed in 2.13.19 (released Oct 31, 2012, 699 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2011-3587](https://cve.now/CVE-2011-3587): Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote… - Severity: Unrated - Published: Oct 10, 2011 - Affected: from 2.12.0, fixed in 2.12.20; from 2.13.0, fixed in 2.13.10; from 2.12.0, fixed in 2.12.20; from 2.13.0, fixed in 2.13.10. - Fixed in 2.12.20 (released Oct 4, 2011, 6 days before disclosure) and 2.13.10 (released Oct 4, 2011, 6 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2011-2528](https://cve.now/CVE-2011-2528): Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2)… - Severity: Unrated - Published: Jul 19, 2011 - Affected: from 2.12.0, fixed in 2.12.19; from 2.13.0, fixed in 2.13.8; from 2.12.0, fixed in 2.12.19; from 2.13.0, fixed in 2.13.8. - Fixed in 2.12.19 (released Jun 28, 2011, 21 days before disclosure) and 2.13.8 (released Jun 28, 2011, 21 days before disclosure). - The latest release, 4.0.0, is not affected. ### [CVE-2010-1104](https://cve.now/CVE-2010-1104): Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6… - Severity: Unrated - Published: Mar 25, 2010 - Affected: from 2.8.0, fixed in 2.8.12; from 2.9.0, fixed in 2.9.12; from 2.10.0, fixed in 2.10.11; from 2.11.0, fixed in 2.11.6; from 2.12.0, fixed in 2.12.3; from 2.8.0, fixed in 2.8.12; from 2.9.0, fixed in 2.9.12; from 2.10.0, fixed in 2.10.11; from 2.11.0, fixed in 2.11.6; from 2.12.0, fixed in 2.12.3. - Fixed in 2.12.3 (released Jan 13, 2010, 71 days before disclosure, the advisory names 2.8.12, which was never published). - The latest release, 4.0.0, is not affected. ### [CVE-2006-4684](https://cve.now/CVE-2006-4684): The docutils module in Zope (Zope2) 2.7.0 through 2.7.9 and 2.8.0 through 2.8.8 does not properly handle web pages with reStructuredText… - Severity: Unrated - Published: Sep 19, 2006 - Affected: from 2.7.0, through 2.7.9; from 2.8.0, fixed in 2.8.9. - Fixed in 2.12.0 (released Sep 30, 2009, 1107 days after disclosure, the advisory names 2.8.9, which was never published). - The latest release, 4.0.0, is not affected. ### [CVE-2006-3458](https://cve.now/CVE-2006-3458): Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with… - Severity: Unrated - Published: Jul 7, 2006 - Affected: from 2.7.0, fixed in 2.7.8; from 2.8.0, fixed in 2.8.7; from 2.9.0, fixed in 2.9.3. - Fixed in 2.12.0 (released Sep 30, 2009, 1181 days after disclosure, the advisory names 2.7.8, which was never published). - The latest release, 4.0.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/zope2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.