CVE-2000-0725

Zope does not properly restrict access to the getRoles method

7.2 HighFix available

CVE-2000-0725 is a high vulnerability (CVSS 7.2) in Zope, published October 13, 2000. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.47%, the 41st percentile. Fixed in zope 2.2.1.

What does this mean?

Severity: 7.2 HighCVSS 2.0, NVD
Exploit chance: 0.47%EPSS, 41st percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 2.2.1zope

Description

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

Exploit likelihood

0.47%Down 0.6 points since Feb 4, 2022

Affected products

zope

Affected packages

Affected packages
Package	Affected	Fixed
`zope` PyPI	before 2.2.1	2.2.1

What each source reports

NVD Score used7.2

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

Record: CVE-2000-0725
CVSS 2.0: 7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Updated: 2026-11-02

CVE ListNo score

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

Record: CVE-2000-0725
Updated: 2026-11-02

EUVDEUVD-2022-1688No score

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

Record: EUVD-2022-1688
Updated: 2026-11-03

GitHub AdvisoriesGHSA-9cmq-pj6p-hgwfNo score

Zope does not properly restrict access to the getRoles method

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

Record: GHSA-9cmq-pj6p-hgwf
Weakness: CWE-284
Updated: 2026-11-02

OSVGHSA-9cmq-pj6p-hgwfNo score

Zope does not properly restrict access to the getRoles method

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

Record: GHSA-9cmq-pj6p-hgwf
Weakness: CWE-284
Updated: 2026-11-02

OSVPYSEC-2026-757No score

Zope does not properly restrict access to the getRoles method

Zope before 2.2.1 does not properly restrict access to the getRoles method, which allows users who can edit DTML to add or modify roles by modifying the roles list that is included in a request.

Record: PYSEC-2026-757
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 10, 2026	facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 6 moreShow less