Skip to content
Fencer Intel
high 7.5

CVE-2021-32811 json

Remote Code Execution via Script (Python) objects under Python 3

published 5y ago modified 4mo ago also GHSA-g4gq-j4p2-j8fr , PYSEC-2021-368 , PYSEC-2021-370 , EUVD-2021-34766

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
2.3%
EPSS 2.3% chance of exploitation in 30 days, percentile 83%
public exploits
0
none known

Summary

Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional `Products.PythonScripts` add-on package installed. By default, one must have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. Zope releases 4.6.3 and 5.3 are not vulnerable. As a workaround, a site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.

Patch / fix

  • pypi zope 4.6.3, 5.3
  • pypi accesscontrol 4.3, 5.2
  • zope accesscontrol 4.3, 5.2
  • zope zope 4.6.3, 5.3

Is CVE-2021-32811 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

2.30% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
pypi zope
>=4.0, <4.6.3
>=5.0, <5.3
4.6.3
5.3
pypi accesscontrol
>=4.0, <4.3
>=5.0, <5.2
4.3
5.2

Affected products

  • zopefoundation Zope

Classification

Weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.