CVE-2023-42458

Zope is an open-source web application server. Prior to versions 4.8.10 and 5.8.5, there is a stored cross site scripting vulnerability for SVG images. Note that an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link. Patches are available in Zope 4.8.10 and 5.8.5. As a workaround, make sure the "Add Documents, Images, and Files" permission is only assigned to trusted roles. By default, only the Manager has this permission.

• CWE-79
• CWE-80

• http://www.openwall.com/lists/oss-security/2023/09/22/2Exploit, Third Party Advisory
• https://github.com/zopefoundation/Zope/commit/26a55dbc301db417f47cafda6fe0f983b5690088Patch
• https://github.com/zopefoundation/Zope/commit/603b0a12881c90a072a7a65e32d47ed898ce37cbPatch
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5vThird Party Advisory
• http://www.openwall.com/lists/oss-security/2023/09/22/2Exploit, Third Party Advisory
• https://github.com/zopefoundation/Zope/commit/26a55dbc301db417f47cafda6fe0f983b5690088Patch
• https://github.com/zopefoundation/Zope/commit/603b0a12881c90a072a7a65e32d47ed898ce37cbPatch
• https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5vThird Party Advisory

Published

Sep 21, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-42452Mastodon is a free, open-source social network server based …5.4
• CVE-2023-42453Synapse is an open-source Matrix homeserver written and main…4.3
• CVE-2023-42454SQLpage is a SQL-only webapp builder. Someone using SQLpage …9.1
• CVE-2023-42455Wazuh is a security detection, visibility, and compliance op…8.8
• CVE-2023-42456Sudo-rs, a memory safe implementation of sudo and su, allows…8.1
• CVE-2023-42457plone.rest allows users to use HTTP verbs such as GET, POST,…7.5
• CVE-2023-42459Fast DDS is a C++ implementation of the DDS (Data Distributi…7.5
• CVE-2023-4246The GiveWP plugin for WordPress is vulnerable to Cross-Site …4.3
• CVE-2023-42460Vyper is a Pythonic Smart Contract Language for the EVM. The…7.5
• CVE-2023-42461GLPI stands for Gestionnaire Libre de Parc Informatique is a…9.8
• CVE-2023-42462GLPI stands for Gestionnaire Libre de Parc Informatique is a…9.1
• CVE-2023-42463Wazuh is a free and open source platform used for threat pre…7.8