CVE
CVE-2024-51734
Access control vulnerable to user data deletion by anonynmous users
Impact
Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access.
Patches
The problem is fixed in version 7.2.
Workarounds
The problem can be fixed by adding dataroles = () to AccessControl.userfolder.UserFolder.
References
https://github.com/zopefoundation/AccessControl/issues/159
Package Versions Affected
Package Version
patch Availability
No items found.
Automatically patch vulnerabilities without upgrading
Fix Without Upgrading
Detect compatible fix
Apply safe remediation
Fix with a single pull request
CVSS Version
Severity
Base Score
CVSS Version
Score Vector
C
H
U
8.7
-
4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
C
H
U
0
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
C
H
U
9.1
-
3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Related Resources
No items found.
References
https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v, https://nvd.nist.gov/vuln/detail/CVE-2024-51734, https://github.com/zopefoundation/AccessControl/issues/159, https://github.com/zopefoundation/AccessControl, https://pypi.org/project/zope, https://github.com/advisories/GHSA-g5vw-3h65-2q3v