{"id":"CVE-2009-0669","aliases":["DSA-1863-1","DSA-2234-1","EUVD-2009-0013","GHSA-5432-c996-hvhj","PYSEC-2009-9"],"status":"published","title":"Zope Object Database (ZODB) Authentication bypass in ZEO storage servers","description":"Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0286,"percentile":0.86852,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2009-08-07T19:00:00Z","modified":"2026-06-16T23:05:32Z","fixes":[{"ecosystem":"PyPI","package":"zodb3","fixed_in":["3.8.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"zodb3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2"}]}]},{"source":"osv","ecosystem":"Debian:5.0","package":"zope2.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.6-1+lenny1"}]}],"versions":["2.10.6-1"],"bundled":2},{"source":"osv","ecosystem":"Debian:4.0","package":"zope2.9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.6-4etch2"}]}],"versions":["2.9.6-4etch1"],"bundled":2},{"source":"osv","ecosystem":"Debian:5.0","package":"zodb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.6.0-2+lenny3"}]}],"versions":["1:3.6.0-2"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"zodb3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2"}]}],"versions":["3.1.5","3.2.10","3.3.1","3.4.2","3.5.0","3.5.1","3.6.0","3.7.0","3.7.2","3.8.0","3.8.0a1","3.8.0b1","3.8.0b2","3.8.0b3","3.8.0b4","3.8.0c1","3.8.1","3.8.1b1","3.8.1b2","3.8.1b3","3.8.1b4","3.8.1b5","3.8.1b6","3.8.1b7","3.8.1b8","3.8.1b9"]},{"source":"osv","ecosystem":"PyPI","package":"zodb3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.2"}]}],"versions":["3.1.5","3.2.10","3.3.1","3.4.2","3.5.0","3.5.1","3.6.0","3.7.0","3.7.2","3.8.0","3.8.0a1","3.8.0b1","3.8.0b2","3.8.0b3","3.8.0b4","3.8.0c1","3.8.1","3.8.1b1","3.8.1b2","3.8.1b3","3.8.1b4","3.8.1b5","3.8.1b6","3.8.1b7","3.8.1b8","3.8.1b9"]}],"products":[{"vendor":"zope","product":"zodb"}],"references":[{"url":"http://www.vupen.com/english/advisories/2009/2217","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/36204","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://osvdb.org/56826","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/52379","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://pypi.python.org/pypi/ZODB3/3.8.2#whats-new-in-zodb-3-8-2","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"http://secunia.com/advisories/36205","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://mail.zope.org/pipermail/zope-announce/2009-August/002220.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/35987","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0669","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2009-9.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5432-c996-hvhj","tags":["advisory"]},{"url":"https://github.com/zopefoundation/ZODB3","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2009-0669","description":"Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.","status":"published","published":"2009-08-07T19:00:00Z","modified":"2024-08-07T04:40:05.323Z","updated_at":"2026-11-02T14:33:25.896677Z"}],"euvd":[{"id":"EUVD-2009-0013","description":"Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.","status":"published","published":"2009-08-07T19:00:00Z","modified":"2024-08-07T04:40:05Z","updated_at":"2026-11-03T01:39:25.189813Z"}],"ghsa":[{"id":"GHSA-5432-c996-hvhj","title":"Zope Object Database (ZODB) Authentication bypass in ZEO storage servers","description":"Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.","status":"published","published":"2022-05-02T03:17:24Z","modified":"2024-11-19T18:33:30Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:38:21.777721Z"}],"nvd":[{"id":"CVE-2009-0669","description":"Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.","status":"published","published":"2009-08-07T19:30:00.233Z","modified":"2026-06-16T23:05:32.087Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:01:36.200173Z"}],"osv":[{"id":"GHSA-5432-c996-hvhj","title":"Zope Object Database (ZODB) Authentication bypass in ZEO storage servers","description":"Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.","status":"published","published":"2022-05-02T03:17:24Z","modified":"2024-11-19T19:00:50.485482Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:L/SA:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:46:37.864461Z"},{"id":"DSA-1863-1","title":"zope2.10 zope2.9 - arbitrary code execution","status":"published","published":"2009-08-15T00:00:00Z","modified":"2026-03-09T01:17:54.634157Z","updated_at":"2026-11-02T15:46:14.734124Z"},{"id":"DSA-2234-1","title":"zodb - several","status":"published","published":"2011-05-10T00:00:00Z","modified":"2026-03-09T01:18:19.487654Z","updated_at":"2026-11-02T15:46:15.108335Z"},{"id":"PYSEC-2009-9","description":"Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to bypass authentication via vectors involving the ZEO network protocol.","status":"published","published":"2009-08-07T19:30:00Z","modified":"2026-06-10T17:00:28.532979344Z","updated_at":"2026-11-02T15:52:51.254177Z"}]}}