CVE-2023-37271
CVSS 3.1 Score 9.9 of 10 (high)
Details
Summary
CVE-2023-37271 is a vulnerability affecting RestrictedPython, a tool used to define a subset of Python for trusted environments. Prior to versions 6.1 and 5.3, this software failed to secure stack frames and their attributes, making them accessible within generators and generator expressions. An attacker in a RestrictedPython environment could exploit this flaw to bypass the sandbox and potentially execute arbitrary code in the Python interpreter. Systems deploying Zope or Plone with untrusted users able to create or edit specific object types - `Script (Python)`, `DTML Method`, `DTML Document`, or `Zope Page Template` - are susceptible to this issue. However, it's worth noting that this non-default configuration is likely rare. The vulnerability has been resolved in versions 6.1 and 5.3.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Zope
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions