CVE-2006-3458: Low severity Zope Zope vulnerability
Published Jul 7, 2006
·Updated
Zope 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3 (Zope2) does not disable the "raw" command when providing untrusted users with restructured text (reStructuredText) functionality from docutils, which allows local users to read arbitrary files.
Affected Software
24 affected componentsFixes available
pip/Zope2>=2.9.0<2.9.3
2.9.3
pip/Zope2>=2.8.0<2.8.7
2.8.7
pip/Zope2>=2.7.0<2.7.8
2.7.8
Zope Zope=2.7.0
Zope Zope=2.7.1
Zope Zope=2.7.2
Zope Zope=2.7.3
Zope Zope=2.7.4
Zope Zope=2.7.5
Zope Zope=2.7.6
Zope Zope=2.7.7
Zope Zope=2.7.8
Zope Zope=2.8.0
Zope Zope=2.8.1
Zope Zope=2.8.2
Zope Zope=2.8.3
Zope Zope=2.8.4
Zope Zope=2.8.5
Zope Zope=2.8.6
Zope Zope=2.8.7
Zope Zope=2.9.0
Zope Zope=2.9.1
Zope Zope=2.9.2
Zope Zope=2.9.3
Event History
Jul 7, 2006
CVE Published
via NVD·11:05 PM
Jul 8, 2006
CVE Published
via MITRE·03:00 AM
Data Sourced
via MITRE·03:00 AM
Description
May 1, 2022
Advisory Published
via GitHub·07:09 AM
Frequently Asked Questions
1
What is the severity of CVE-2006-3458?
CVE-2006-3458 is considered a moderate vulnerability due to its potential for local users to access arbitrary files.
2
How do I fix CVE-2006-3458?
To fix CVE-2006-3458, upgrade to Zope2 versions 2.7.8, 2.8.7, or 2.9.3.
3
Which versions are affected by CVE-2006-3458?
CVE-2006-3458 affects Zope2 versions 2.7.0 to 2.7.8, 2.8.0 to 2.8.7, and 2.9.0 to 2.9.3.
4
What type of attack does CVE-2006-3458 enable?
CVE-2006-3458 enables local users to read arbitrary files on the system.
5
Is CVE-2006-3458 related to user permissions?
Yes, CVE-2006-3458 exploits insufficient restrictions on commands available to untrusted users.