-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from str.format_map not being properly secured in AccessControl. The patch explicitly adds a safe_format_map replacement in src/AccessControl/init.py, indicating the original method was vulnerable. Pre-patch versions allowed attackers to use Python's native implementation without security checks, leading to information disclosure. The commit diff confirms format_map was added to the security rules post-fix.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| AccessControl | pip | < 4.4 | 4.4 |
| Zope | pip | < 4.8.9 | 4.8.9 |
| AccessControl | pip | >= 5.0, < 5.8 | 5.8 |
| AccessControl | pip | >= 6.0, < 6.2 | 6.2 |
| Zope | pip | >= 5.0.0, < 5.8.4 | 5.8.4 |