Vulnerability-Lookup

CVE-2009-2701 (GCVE-0-2009-2701)

Vulnerability from cvelistv5 – Published: 2009-09-08 18:00 – Updated: 2024-09-16 20:36

Summary

Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.

Severity

No CVSS data available.

CWE

Assigner

mitre

References

4 references

URL	Tags
https://mail.zope.org/pipermail/zope-announce/200…	mailing-listx_refsource_MLIST
http://pypi.python.org/pypi/ZODB3/3.8.3	x_refsource_CONFIRM
http://www.vupen.com/english/advisories/2009/2534	vdb-entryx_refsource_VUPEN
http://pypi.python.org/pypi/ZODB3/3.9.0c2	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:59:56.947Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[zope-announce] 20090901 CVE-2009-2701: Releases to fix ZODB ZEO server vulnerability",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://pypi.python.org/pypi/ZODB3/3.8.3"
          },
          {
            "name": "ADV-2009-2534",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2534"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://pypi.python.org/pypi/ZODB3/3.9.0c2"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2009-09-08T18:00:00.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[zope-announce] 20090901 CVE-2009-2701: Releases to fix ZODB ZEO server vulnerability",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://pypi.python.org/pypi/ZODB3/3.8.3"
        },
        {
          "name": "ADV-2009-2534",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2534"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://pypi.python.org/pypi/ZODB3/3.9.0c2"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2701",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[zope-announce] 20090901 CVE-2009-2701: Releases to fix ZODB ZEO server vulnerability",
              "refsource": "MLIST",
              "url": "https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html"
            },
            {
              "name": "http://pypi.python.org/pypi/ZODB3/3.8.3",
              "refsource": "CONFIRM",
              "url": "http://pypi.python.org/pypi/ZODB3/3.8.3"
            },
            {
              "name": "ADV-2009-2534",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/2534"
            },
            {
              "name": "http://pypi.python.org/pypi/ZODB3/3.9.0c2",
              "refsource": "CONFIRM",
              "url": "http://pypi.python.org/pypi/ZODB3/3.9.0c2"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2701",
    "datePublished": "2009-09-08T18:00:00.000Z",
    "dateReserved": "2009-08-05T00:00:00.000Z",
    "dateUpdated": "2024-09-16T20:36:27.354Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2009-2701",
      "date": "2026-07-27",
      "epss": "0.00971",
      "percentile": "0.58273"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zope:zodb:3.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF49B253-411F-4E83-93B3-556783B73965\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zope:zodb:3.8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8568BD1E-839A-4C78-840D-47807D207C6F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zope:zodb:3.8.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"552E429F-964F-4BF8-B974-C4C59EA7871F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zope:zodb:3.8.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"204FA56B-576D-4274-B17C-6AC4FC1EB58B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zope:zodb:3.9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8C5CCCAA-83AD-4CD6-B7FD-46809B786395\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zope:zodb:3.9.0b1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2F38F2B2-E061-4D77-9A88-1C432F31FAFA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zope:zodb:3.9.0b2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EFA88DF5-7A25-4187-8B9D-567B0279FEAD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zope:zodb:3.9.0b3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DCFE0BF9-0AC2-4461-BAAE-BDE91A830788\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zope:zodb:3.9.0b4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF8EA11C-98BD-419F-9817-4071B287F87B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zope:zodb:3.9.0b5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"283DC1FE-6F98-4FFA-A17F-6277AB9815C9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:zope:zodb:3.9.0c1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7A991E3D-03E9-4B2F-90FB-0B308D142B20\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad no especificada en Zope Enterprise Objects (ZEO) funcionalidad storage-server en Zope Object Database (ZODB) v3.8 anterior v3.8.3 y v3.9.x anterior v3.9.0c2, cuando cierta base de datos ZEO compartida y el soporte blob es activado, permite usuarios autenticarse remotamente para leer o borrar archivos de su elecci\\u00f3n a trav\\u00e9s de vectores desconocidos.\"}]",
      "id": "CVE-2009-2701",
      "lastModified": "2024-11-21T01:05:33.307",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:S/C:P/I:P/A:P\", \"baseScore\": 6.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"SINGLE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 6.8, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2009-09-08T18:30:00.233",
      "references": "[{\"url\": \"http://pypi.python.org/pypi/ZODB3/3.8.3\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\"]}, {\"url\": \"http://pypi.python.org/pypi/ZODB3/3.9.0c2\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.vupen.com/english/advisories/2009/2534\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html\", \"source\": \"cve@mitre.org\", \"tags\": [\"Patch\"]}, {\"url\": \"http://pypi.python.org/pypi/ZODB3/3.8.3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"http://pypi.python.org/pypi/ZODB3/3.9.0c2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}, {\"url\": \"http://www.vupen.com/english/advisories/2009/2534\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2009-2701\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2009-09-08T18:30:00.233\",\"lastModified\":\"2026-04-23T00:35:47.467\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad no especificada en Zope Enterprise Objects (ZEO) funcionalidad storage-server en Zope Object Database (ZODB) v3.8 anterior v3.8.3 y v3.9.x anterior v3.9.0c2, cuando cierta base de datos ZEO compartida y el soporte blob es activado, permite usuarios autenticarse remotamente para leer o borrar archivos de su elecci\u00f3n a trav\u00e9s de vectores desconocidos.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:P/I:P/A:P\",\"baseScore\":6.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":6.8,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zope:zodb:3.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF49B253-411F-4E83-93B3-556783B73965\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zope:zodb:3.8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8568BD1E-839A-4C78-840D-47807D207C6F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zope:zodb:3.8.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"552E429F-964F-4BF8-B974-C4C59EA7871F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zope:zodb:3.8.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"204FA56B-576D-4274-B17C-6AC4FC1EB58B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zope:zodb:3.9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C5CCCAA-83AD-4CD6-B7FD-46809B786395\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zope:zodb:3.9.0b1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F38F2B2-E061-4D77-9A88-1C432F31FAFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zope:zodb:3.9.0b2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EFA88DF5-7A25-4187-8B9D-567B0279FEAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zope:zodb:3.9.0b3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCFE0BF9-0AC2-4461-BAAE-BDE91A830788\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zope:zodb:3.9.0b4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF8EA11C-98BD-419F-9817-4071B287F87B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zope:zodb:3.9.0b5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"283DC1FE-6F98-4FFA-A17F-6277AB9815C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zope:zodb:3.9.0c1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7A991E3D-03E9-4B2F-90FB-0B308D142B20\"}]}]}],\"references\":[{\"url\":\"http://pypi.python.org/pypi/ZODB3/3.8.3\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://pypi.python.org/pypi/ZODB3/3.9.0c2\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.vupen.com/english/advisories/2009/2534\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\"]},{\"url\":\"http://pypi.python.org/pypi/ZODB3/3.8.3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://pypi.python.org/pypi/ZODB3/3.9.0c2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"http://www.vupen.com/english/advisories/2009/2534\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2025-11-21T13:10:44+00:00",
      "cve": "CVE-2009-2701",
      "id": "CVE-2009-2701",
      "initial_release_date": "2009-09-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Zope: Information disclosure (files read, removal) when ZEO server configured with blobs support",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2009/cve-2009-2701.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2023-02-15T06:03:07Z",
      "cve": "CVE-2009-2701",
      "id": "CVE-2009-2701",
      "initial_release_date": "2023-02-15T06:03:07Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2009-2701",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2009-2701.json",
      "version": "2"
    }
  }
}

FKIE_CVE-2009-2701

Vulnerability from fkie_nvd - Published: 2009-09-08 18:30 - Updated: 2026-06-16 23:10

Severity

Summary

References

URL	Tags
cve@mitre.org	http://pypi.python.org/pypi/ZODB3/3.8.3	Patch
cve@mitre.org	http://pypi.python.org/pypi/ZODB3/3.9.0c2	Patch
cve@mitre.org	http://www.vupen.com/english/advisories/2009/2534	Patch, Vendor Advisory
cve@mitre.org	https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html	Patch
af854a3a-2127-422b-91ae-364da2661108	http://pypi.python.org/pypi/ZODB3/3.8.3	Patch
af854a3a-2127-422b-91ae-364da2661108	http://pypi.python.org/pypi/ZODB3/3.9.0c2	Patch
af854a3a-2127-422b-91ae-364da2661108	http://www.vupen.com/english/advisories/2009/2534	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html	Patch

Impacted products

Vendor	Product	Version
zope	zodb	3.8
zope	zodb	3.8.0
zope	zodb	3.8.1
zope	zodb	3.8.2
zope	zodb	3.9.0
zope	zodb	3.9.0b1
zope	zodb	3.9.0b2
zope	zodb	3.9.0b3
zope	zodb	3.9.0b4
zope	zodb	3.9.0b5
zope	zodb	3.9.0c1

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zope:zodb:3.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF49B253-411F-4E83-93B3-556783B73965",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zope:zodb:3.8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8568BD1E-839A-4C78-840D-47807D207C6F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zope:zodb:3.8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "552E429F-964F-4BF8-B974-C4C59EA7871F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zope:zodb:3.8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "204FA56B-576D-4274-B17C-6AC4FC1EB58B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zope:zodb:3.9.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "8C5CCCAA-83AD-4CD6-B7FD-46809B786395",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zope:zodb:3.9.0b1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F38F2B2-E061-4D77-9A88-1C432F31FAFA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zope:zodb:3.9.0b2:*:*:*:*:*:*:*",
              "matchCriteriaId": "EFA88DF5-7A25-4187-8B9D-567B0279FEAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zope:zodb:3.9.0b3:*:*:*:*:*:*:*",
              "matchCriteriaId": "DCFE0BF9-0AC2-4461-BAAE-BDE91A830788",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zope:zodb:3.9.0b4:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF8EA11C-98BD-419F-9817-4071B287F87B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zope:zodb:3.9.0b5:*:*:*:*:*:*:*",
              "matchCriteriaId": "283DC1FE-6F98-4FFA-A17F-6277AB9815C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:zope:zodb:3.9.0c1:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A991E3D-03E9-4B2F-90FB-0B308D142B20",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad no especificada en Zope Enterprise Objects (ZEO) funcionalidad storage-server en Zope Object Database (ZODB) v3.8 anterior v3.8.3 y v3.9.x anterior v3.9.0c2, cuando cierta base de datos ZEO compartida y el soporte blob es activado, permite usuarios autenticarse remotamente para leer o borrar archivos de su elecci\u00f3n a trav\u00e9s de vectores desconocidos."
    }
  ],
  "id": "CVE-2009-2701",
  "lastModified": "2026-06-16T23:10:04.030",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-09-08T18:30:00.233",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://pypi.python.org/pypi/ZODB3/3.8.3"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://pypi.python.org/pypi/ZODB3/3.9.0c2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/2534"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://pypi.python.org/pypi/ZODB3/3.8.3"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://pypi.python.org/pypi/ZODB3/3.9.0c2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/2534"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-M52M-2QPX-9J4J

Vulnerability from github – Published: 2022-05-02 03:37 – Updated: 2024-11-19 18:34

Summary

Zope Object Database (ZODB) Arbitrary files reading and deletion

Details

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ZODB3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.8"
            },
            {
              "fixed": "3.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ZODB3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.9a0"
            },
            {
              "fixed": "3.9.0c2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2009-2701"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-22T18:59:10Z",
    "nvd_published_at": "2009-09-08T18:30:00Z",
    "severity": "CRITICAL"
  },
  "details": "Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.",
  "id": "GHSA-m52m-2qpx-9j4j",
  "modified": "2024-11-19T18:34:25Z",
  "published": "2022-05-02T03:37:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2009-2701"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-10.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/zopefoundation/ZODB3"
    },
    {
      "type": "WEB",
      "url": "https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html"
    },
    {
      "type": "WEB",
      "url": "http://pypi.python.org/pypi/ZODB3/3.8.3"
    },
    {
      "type": "WEB",
      "url": "http://pypi.python.org/pypi/ZODB3/3.9.0c2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Zope Object Database (ZODB) Arbitrary files reading and deletion"
}

GSD-2009-2701

Vulnerability from gsd - Updated: 2023-12-13 01:19

Details

Aliases

CVE-2009-2701

Aliases

CVE-2009-2701

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2009-2701",
    "description": "Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.",
    "id": "GSD-2009-2701",
    "references": [
      "https://www.suse.com/security/cve/CVE-2009-2701.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2009-2701"
      ],
      "details": "Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.",
      "id": "GSD-2009-2701",
      "modified": "2023-12-13T01:19:46.631719Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2009-2701",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "[zope-announce] 20090901 CVE-2009-2701: Releases to fix ZODB ZEO server vulnerability",
            "refsource": "MLIST",
            "url": "https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html"
          },
          {
            "name": "http://pypi.python.org/pypi/ZODB3/3.8.3",
            "refsource": "CONFIRM",
            "url": "http://pypi.python.org/pypi/ZODB3/3.8.3"
          },
          {
            "name": "ADV-2009-2534",
            "refsource": "VUPEN",
            "url": "http://www.vupen.com/english/advisories/2009/2534"
          },
          {
            "name": "http://pypi.python.org/pypi/ZODB3/3.9.0c2",
            "refsource": "CONFIRM",
            "url": "http://pypi.python.org/pypi/ZODB3/3.9.0c2"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:zope:zodb:3.9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zope:zodb:3.8.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zope:zodb:3.8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zope:zodb:3.9.0b5:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zope:zodb:3.9.0b4:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zope:zodb:3.9.0b3:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zope:zodb:3.9.0b2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zope:zodb:3.8:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zope:zodb:3.9.0c1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zope:zodb:3.9.0b1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:zope:zodb:3.8.2:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2701"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[zope-announce] 20090901 CVE-2009-2701: Releases to fix ZODB ZEO server vulnerability",
              "refsource": "MLIST",
              "tags": [
                "Patch"
              ],
              "url": "https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html"
            },
            {
              "name": "http://pypi.python.org/pypi/ZODB3/3.9.0c2",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "http://pypi.python.org/pypi/ZODB3/3.9.0c2"
            },
            {
              "name": "http://pypi.python.org/pypi/ZODB3/3.8.3",
              "refsource": "CONFIRM",
              "tags": [
                "Patch"
              ],
              "url": "http://pypi.python.org/pypi/ZODB3/3.8.3"
            },
            {
              "name": "ADV-2009-2534",
              "refsource": "VUPEN",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "http://www.vupen.com/english/advisories/2009/2534"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 6.8,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        }
      },
      "lastModifiedDate": "2009-09-09T04:00Z",
      "publishedDate": "2009-09-08T18:30Z"
    }
  }
}

PYSEC-2009-10

Vulnerability from pysec - Published: 2009-09-08 18:30 - Updated: 2024-01-17 10:48

Details

Impacted products

Name	purl
zodb3	pkg:pypi/zodb3

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "zodb3",
        "purl": "pkg:pypi/zodb3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.8"
            },
            {
              "fixed": "3.8.3"
            },
            {
              "introduced": "3.9a0"
            },
            {
              "fixed": "3.9.0c2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.8.0",
        "3.8.1",
        "3.8.1b1",
        "3.8.1b2",
        "3.8.1b3",
        "3.8.1b4",
        "3.8.1b5",
        "3.8.1b6",
        "3.8.1b7",
        "3.8.1b8",
        "3.8.1b9",
        "3.8.2",
        "3.8.3b1",
        "3.9.0a1",
        "3.9.0a10",
        "3.9.0a11",
        "3.9.0a12",
        "3.9.0a2",
        "3.9.0a3",
        "3.9.0a4",
        "3.9.0a5",
        "3.9.0a6",
        "3.9.0a7",
        "3.9.0a9",
        "3.9.0b1",
        "3.9.0b2",
        "3.9.0b3",
        "3.9.0b4",
        "3.9.0b5",
        "3.9.0c1"
      ]
    }
  ],
  "aliases": [
    "CVE-2009-2701",
    "GHSA-m52m-2qpx-9j4j"
  ],
  "details": "Unspecified vulnerability in the Zope Enterprise Objects (ZEO) storage-server functionality in Zope Object Database (ZODB) 3.8 before 3.8.3 and 3.9.x before 3.9.0c2, when certain ZEO database sharing and blob support are enabled, allows remote authenticated users to read or delete arbitrary files via unknown vectors.",
  "id": "PYSEC-2009-10",
  "modified": "2024-01-17T10:48:40.464440Z",
  "published": "2009-09-08T18:30:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://mail.zope.org/pipermail/zope-announce/2009-September/002221.html"
    },
    {
      "type": "WEB",
      "url": "http://pypi.python.org/pypi/ZODB3/3.9.0c2"
    },
    {
      "type": "WEB",
      "url": "http://pypi.python.org/pypi/ZODB3/3.8.3"
    },
    {
      "type": "ADVISORY",
      "url": "http://www.vupen.com/english/advisories/2009/2534"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-m52m-2qpx-9j4j"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2009-2701 (GCVE-0-2009-2701)

FKIE_CVE-2009-2701

GHSA-M52M-2QPX-9J4J

GSD-2009-2701

PYSEC-2009-10

Tags

Sightings

Nomenclature