Vulnerability Description
Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.
Related Weaknesses (CWE)
References
- https://github.com/zopefoundation/AccessControl/issues/159
- https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h
FAQ
What is CVE-2024-51734?
CVE-2024-51734 is a documented vulnerability. Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may...
How severe is CVE-2024-51734?
CVSS scoring is not yet available for CVE-2024-51734. Check NVD for updates.
Is there a patch for CVE-2024-51734?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.