Vulnerability · Published Nov 4, 2024 · Assigned by GitHub_M

CVE-2024-51734User data deletion by anoynmous users in Zope

High 8.7

In plain English

A high-severity improper access control in AccessControl from zopefoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 62.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	accesscontrol	7.2	GHSA-g5vw-3h65-2q3v
PyPI	accesscontrol	7.2	PYSEC-2026-2326
PyPI	zope	5.11.1	GHSA-g5vw-3h65-2q3v
PyPI	zope	5.11.1	PYSEC-2026-2076

Affected products (as reported)

Vendor	Product	Versions
zopefoundation	AccessControl	Zope AccessControl: < 7.2Zope bundle: < 5.11.1

Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v x_refsource_CONFIRM
https://github.com/zopefoundation/AccessControl/issues/159 x_refsource_MISC