High severity · published Nov 4, 2024
CVE-2024-51734
User data deletion by anoynmous users in Zope
8.7
CVSS
0.4%
EPSS
No
On KEV
Description
Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
AccessControl · zopefoundation
Zope AccessControl: < 7.2; Zope bundle: < 5.11.1 · source: vendor, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-51734
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-51734
github.com
https://github.com/zopefoundation/AccessControl/issues/159
github.com
https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v
More from AccessControl
7.7
CVE-2023-41050
Information disclosure through Python's "format" functionality in Zope AccessControl
6.8
CVE-2026-77401
Zope AccessControl: Information disclosure through Python string `format` and `format_map` functions