Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2024-51734

User data deletion by anoynmous users in Zope

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

zopefoundation AccessControl

  • Zope AccessControl: < 7.2affected
  • Zope bundle: < 5.11.1affected

References