CVE-2023-44389
Zope management interface vulnerable to stored cross site scripting via the title property
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Zope management interface vulnerable to stored cross site scripting via the title property
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
- Record
CVE-2023-44389- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2023-0286
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
- Record
EUVD-2023-0286- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m755-gxxg-r5qh
Zope management interface vulnerable to stored cross site scripting via the title property
Impact
The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI) because the title property is displayed unquoted in the breadcrumbs element. All versions of Zope 4 and Zope 5 are affected.
Patches
Patches will be released with Zope versions 4.8.11 and 5.8.6.
Workarounds
Make sure only Manager users can edit and view Zope objects in the Zope Management Interface. This is the default.
- Record
GHSA-m755-gxxg-r5qh- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
- Record
CVE-2023-44389- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N - CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Zope management interface vulnerable to stored cross site scripting via the title property
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6.
- Record
CVE-2023-44389- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-m755-gxxg-r5qh
Zope management interface vulnerable to stored cross site scripting via the title property
Impact
The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI) because the title property is displayed unquoted in the breadcrumbs element. All versions of Zope 4 and Zope 5 are affected.
Patches
Patches will be released with Zope versions 4.8.11 and 5.8.6.
Workarounds
Make sure only Manager users can edit and view Zope objects in the Zope Management Interface. This is the default.
- Record
GHSA-m755-gxxg-r5qh- CVSS 3.1
- 3.1 Low
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVPYSEC-2023-193
Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the affected object in the Zope Management Interface (ZMI). All versions of Zope 4 and Zope 5 are affected. Patches will be released with Zope versions 4.8.11 and 5.8.6
- Record
PYSEC-2023-193- CVSS 3.1
- 4.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zopePyPI |
5.0.0 up to 5.8.6 | 5.8.6 |
zopePyPI |
4.0.0 up to 4.8.11 | 4.8.11 |
zopePyPI |
4.0.0 up to 4.8.11, plus listed versions 4.04.14.1.14.1.24.1.3 Show 30 moreShow less4.24.2.14.34.44.4.14.4.24.4.34.4.44.54.5.14.5.24.5.34.5.44.5.54.64.6.14.6.24.6.34.74.84.8.14.8.104.8.24.8.34.8.44.8.54.8.64.8.74.8.84.8.9 |
4.8.11 |
zopePyPI |
5.0.0 up to 5.8.6, plus listed versions 5.05.15.1.15.1.25.2 Show 17 moreShow less5.2.15.35.45.55.5.15.5.25.65.75.7.15.7.25.7.35.85.8.15.8.25.8.35.8.45.8.5 |
5.8.6 |
zopePyPI |
5.0 up to 5.8.6, 4.0 up to 4.8.11, plus listed versions 4.14.1.14.1.24.1.34.2 Show 45 moreShow less4.2.14.34.44.4.14.4.24.4.34.4.44.54.5.14.5.24.5.34.5.44.5.54.64.6.14.6.24.6.34.74.84.8.14.8.104.8.24.8.34.8.44.8.54.8.64.8.74.8.84.8.95.15.1.15.1.25.25.2.15.35.45.55.5.15.5.25.65.75.7.15.7.25.7.35.8 |
5.8.64.8.11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-44389 is a low vulnerability (CVSS 3.1) in Zope, published October 4, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in zope 5.8.6.
References
github.com/zopefoundation/Zope/security/advisories/GHSA-m755-gxxg-r5qh
nvd.nist.gov/vuln/detail/CVE-2023-44389
Left out here: 5 versions. The JSON record has them.