CVE-2011-4924 json
Zope XSS Vulnerability
published 2019-11-25 6 y ago modified 2026-07-13 3 mo ago also GHSA-vh6g-786f-hxxp , PYSEC-2026-3440 , PYSEC-2026-766 , EUVD-2022-1838
- cvss
- 6.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.4%
- EPSS 1.4% chance of exploitation in 30 days, percentile 71%
- public exploits
- 0
- none known
Summary
Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104
Patch / fix
- pypi zope 3.7.3
- pypi zope2 2.12.22, 2.13.12
- zope zope 2.8.12, 2.9.12, 2.10.11, 2.11.6, 2.12.3
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2011-4924 updated cvss 4.3
Zope: Incomplete upstream patch for CVE-2010-1104 issue
-
Red Hat Enterprise Linux 5 conganot affected: vulnerable code not present
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
1.36% chance of exploitation in the next 30 days, higher than 71% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | zope | >=3.1.1, <3.7.3 |
3.7.3 |
| pypi | zope2 | <2.12.22 >=2.13.0a1, <2.13.12 |
2.12.22 2.13.12 |
Affected products
- zope zope2, zope3
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/zopefoundation/Zope/commit/37e4ea774acc668f6b430a45a6ab1e359710f590
web
-
github.com
/zopefoundation/Zope/commit/a0655194cb39ad88ce3323a3e489927c5f979c44
web
-
security-tracker.debian.org
/tracker/CVE-2011-4924
web, third-party-advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=CVE-2011-4924
web, issue-tracking, third-party-advisory
-
access.redhat.com
/security/cve/cve-2011-4924
web, third-party-advisory
-
openwall.com
/lists/oss-security/2012/01/19/19
web, mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2012/01/19/16
web, mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2012/01/19/17
web, mailing-list, third-party-advisory
-
openwall.com
/lists/oss-security/2012/01/19/18
web, mailing-list, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2011-4924
advisory
-
github.com
/zopefoundation/Zope
package
-
pypi.org
/project/zope2
package
-
github.com
/advisories/GHSA-vh6g-786f-hxxp
advisory
-
pypi.org
/project/zope
package
Sources
- CVE List CVE-2011-4924
- GitHub Advisory GHSA-vh6g-786f-hxxp
- NVD CVE-2011-4924
- OSV PYSEC-2026-766
- OSV PYSEC-2026-3440
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.