Zope contains a flaw that may allow a malicious user to gain access to files outside the configured security context. The issue is due to Zope failing to honour the security context of the creator of a proxy role when determining access to an object via that role. This flaw may lead to a loss of confidentiality.
Classification
Location:
Remote / Network Access
Attack Type:
Authentication Management,
Information Disclosure
Impact:
Loss of Confidentiality
Exploit:
Exploit Unknown
Solution
Upgrade to version 2.4.4 or 2.5.1 and higher, as these versions have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
zope.com -
Zope
