[security-alerts] FW: [SA24017] Zope Cross-Site Request Forgery Vulnerabilities

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> ----------------------------------------------------------------------
> 
> TITLE:
> Zope Cross-Site Request Forgery Vulnerabilities
> 
> SECUNIA ADVISORY ID:
> SA24017
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/24017/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> Cross Site Scripting
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> Zope 2.x
> http://secunia.com/product/397/
> 
> DESCRIPTION:
> Some vulnerabilities have been reported in Zope, which can be
> exploited by malicious people to conduct cross-site request forgery
> attacks
> 
> The vulnerabilities are caused due to Zope allowing administrators to
> perform certain actions via HTTP requests without performing any
> validity checks to verify the request. This can be exploited to e.g.
> to add users or change user privileges by enticing a logged-in
> administrator to visit a malicious site.
> 
> The vulnerability is reported in all Zope versions up to and
> including 2.10.2.
> 
> SOLUTION:
> Apply hotfix:
> http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view
> 
> NOTE: This hotfix only protects against malicious HTTP GET requests.
> Exploitation via POST requests is still possible.
> 
> PROVIDED AND/OR DISCOVERED BY:
> Reported by the vendor.
> 
> ORIGINAL ADVISORY:
> http://www.zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view
>