CVE-2011-4924

2019-11-2517:03:14

redhat

www.cve.org

EPSS

0.003

Percentile

65.7%

JSON

Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12, 2.9.x before 2.9.12, 2.10.x before 2.10.11, 2.11.x before 2.11.6, and 2.12.x before 2.12.3, 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104

CNA Affected

[
  {
    "product": "zope2, zope3",
    "vendor": "zope",
    "versions": [
      {
        "status": "affected",
        "version": "2.8.x before 2.8.12"
      },
      {
        "status": "affected",
        "version": "2.9.x before 2.9.12"
      },
      {
        "status": "affected",
        "version": "2.10.x before 2.10.11"
      },
      {
        "status": "affected",
        "version": "2.11.x before 2.11.6"
      },
      {
        "status": "affected",
        "version": "and 2.12.x before 2.12.3"
      },
      {
        "status": "affected",
        "version": "3.1.1through 3.4.1"
      }
    ]
  }
]