Author: JT Smith
LinuxSecurity posts news of a new Zope hotfix available fixing an issue that became known late last month: “”The issue involves the fmt attribute of dtml-var tags. Without this
correction, Zope does not check security access to methods invoked
through fmt. This issue could allow partially trusted users with
enough knowledge of Zope to call, in a limited way, methods they would
not otherwise be allowed to access.”
correction, Zope does not check security access to methods invoked
through fmt. This issue could allow partially trusted users with
enough knowledge of Zope to call, in a limited way, methods they would
not otherwise be allowed to access.”
Category:
- Linux
