From the Zope site:
The issue involves an error in the 'aq_inContextOf' method of objects that
support acquisition. A recent change to the access validation machinery
made this bug begin to affect security restrictions. The bug, with the
change to validation, made it possible to access Zope objects via
acquisition that a user would not otherwise have access to. This issue
could allow users with enough internal knowledge of Zope to perform actions
higher in the object hierarchy than they should be able to.
From the Zope hotfix:
This hotfix addresses and important security issue that affects Zope
versions up to and including Zope 2.3.1 b1.
The issue is related to ZClasses in that a user with through-the-web
scripting capabilities on a Zope site can view and assign class
attributes to ZClasses, possibly allowing them to make inappropriate
changes to ZClass instances.
This patch also fixes problems in the ObjectManager, PropertyManager,
and PropertySheet classes related to mutability of method return values
which could be perceived as a security problem.
We *highly* recommend that any Zope site running versions of Zope up to
and including 2.3.1 b1 have this hotfix product installed to mitigate
these issues if the site is accessible by untrusted users who have
through-the-web scripting privileges.
which allows people who may edit DTML to gain higher privilege, and
those who have higher privilege in some areas of the Zope tree to gain
it in other areas.
