Loading HuntDB...
Hunt
Vulnerability Intelligence by wss.sh
Home Daily Briefings High Impact CVEs Recent Exploits KEV Catalog GitHub Advisories Latest Updates Security News
Sign In Sign Up

CVE-2024-51734

UNKNOWN
Published 2024-11-04T22:25:22.076Z
Actions:

Expert Analysis

Professional remediation guidance

Get tailored security recommendations from our analyst team for CVE-2024-51734. We'll provide specific mitigation strategies based on your environment and risk profile.

No CVSS data available

Description

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.

Available Exploits

No exploits available for this CVE.

Related News

No news articles found for this CVE.

Affected Products

zopefoundation

AccessControl

Affected Versions:

Zope AccessControl: < 7.2 Zope bundle: < 5.11.1
zope

accesscontrol

Affected Versions:

0
zope

accesscontrol

Affected Versions:

0

GitHub Security Advisories

Community-driven vulnerability intelligence from GitHub

✓ GitHub Reviewed MODERATE

Access control vulnerable to user data deletion by anonynmous users

GHSA-g5vw-3h65-2q3v

Advisory Details

### Impact Anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. ### Patches The problem is fixed in version 7.2. ### Workarounds The problem can be fixed by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`. ### References https://github.com/zopefoundation/AccessControl/issues/159

Affected Packages

PyPI AccessControl
ECOSYSTEM: ≥0 <7.2
PyPI Zope
ECOSYSTEM: ≥0 <5.11.1

CVSS Scoring

CVSS Score

5.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

WEB https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-51734
WEB https://github.com/zopefoundation/AccessControl/issues/159
PACKAGE https://github.com/zopefoundation/AccessControl

Advisory provided by GitHub Security Advisory Database. Published: November 4, 2024, Modified: November 5, 2024

References

https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v
https://github.com/zopefoundation/AccessControl/issues/159
Published: 2024-11-04T22:25:22.076Z
Last Modified: 2025-01-22T20:12:19.451Z
Copied to clipboard!