Home > Vulnerability Database > CVE-2024-51734

Mend.io Vulnerability Database

CVE-2024-51734

Good to know:

Date: November 4, 2024

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.

Language: Python

Severity Score

0.0

Related Resources (5)

Url: https://github.com/zopefoundation/AccessControl

Url: https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v

Url: https://github.com/zopefoundation/AccessControl/issues/159

Url: https://nvd.nist.gov/vuln/detail/CVE-2024-51734

Url: https://www.mend.io/vulnerability-database/CVE-2024-51734

Weakness Type (CWE)

Improper Access Control

CWE-284

Improper Privilege Management

CWE-269

Top Fix

Upgrade Version

Upgrade to version AccessControl - 7.2

Learn More

CVSS v3.1

Base Score:	0.0
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	NONE