GitHub Advisoryadvisory · PyPI

GHSA-g5vw-3h65-2q3v Access control vulnerable to user data deletion by anonynmous users

MEDIUM Published 2024-11-04 Modified 2024-11-05 Official page ↗
Aliases
CVE-2024-51734
Ecosystem
PyPI
Packages
AccessControl, Zope
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-269, CWE-284
Reviewed
2024-11-04

Affected packages

• PyPI AccessControl: < 7.2 → fixed in 7.2 • PyPI Zope: < 5.11.1 → fixed in 5.11.1

Description

Impact Anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. Patches The problem is fixed in version 7.2. Workarounds The problem can be fixed by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`. References https://github.com/zopefoundation/AccessControl/issues/159

Related

Alias · CVE (1)

  • CVE-2024-51734 Zope AccessControl provides a general security framework for use in Zope. vulnerability

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-284 Improper Access Control weakness

References