CVE-2007-0240
Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to...
CVE-2007-0240 is a medium vulnerability (CVSS 4.3) in Zope, published March 22, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.61%, the 76th percentile. Fixed in zope2.7 2.7.5-2sarge4.
- Severity
- 4.3 MediumCVSS 2.0, NVD
- Exploit chance
- 1.61%EPSS, 76th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.7.5-2sarge4zope2.7 +4 more
Description
Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
zope2.7Debian:3.1 | before 2.7.5-2sarge4, plus listed versions 2.7.5-22.7.5-2sarge12.7.5-2sarge22.7.5-2sarge3 | 2.7.5-2sarge4 |
congaRed Hat:rhel_cluster:5 From an advisory covering 2 CVEs | before 0:0.9.2-6.el5 | 0:0.9.2-6.el5 |
conga-debuginfoRed Hat:rhel_cluster:5 From an advisory covering 2 CVEs | before 0:0.9.2-6.el5 | 0:0.9.2-6.el5 |
luciRed Hat:rhel_cluster:5 From an advisory covering 2 CVEs | before 0:0.9.2-6.el5 | 0:0.9.2-6.el5 |
ricciRed Hat:rhel_cluster:5 From an advisory covering 2 CVEs | before 0:0.9.2-6.el5 | 0:0.9.2-6.el5 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request.
- Record
CVE-2007-0240- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request.
- Record
CVE-2007-0240- Updated
- 2026-11-02
EUVDEUVD-2007-0242No score
Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request.
- Record
EUVD-2007-0242- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3crq-2hxh-cq5fNo score
Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to...
Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request.
- Record
GHSA-3crq-2hxh-cq5f- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
vupen.com/english/advisories/2007/1041
debian.org/security/2007/dsa-1275
securityfocus.com/bid/23084
secunia.com/advisories/24017
lists.suse.com/archive/suse-security-announce/2007-May/0005.html
zope.org/Products/Zope/Hotfix-2007-03-20/announcement/view
Show 26 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/33187
nvd.nist.gov/vuln/detail/CVE-2007-0240
github.com/advisories/GHSA-3crq-2hxh-cq5f
access.redhat.com/errata/RHBA-2007:0331
bugzilla.redhat.com/show_bug.cgi?id=228637
security.access.redhat.com/data/csaf/v2/advisories/2006/rhba-2007_0331.json
cve.org/CVERecord?id=CVE-2007-0240