Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2000-0725

Overview
Vulnerability Score	7.2
CVE Id	CVE-2000-0725
Last Modified	10 Sep 2008 03:05:42
Published	20 Oct 2000 12:00:00
Confidentiality Impact	COMPLETE
Integrity Impact	COMPLETE
Availability Impact	COMPLETE
Access Vector	LOCAL
Access Complexity	LOW
Authentication	NONE

CVE-2000-0725

Summary

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.