CVE-2024-51734CWE-284

User data deletion by anoynmous users in Zope

High · published November 4, 2024

CVSS v4.0
8.7
EPSS
0%
Percentile
36.7
In the wild
Unconfirmed
What it is

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00434 · 36.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2024-11-04T22:25Z
EPSS history
Timeline
  • 04 NOV 22:25Z
    User data deletion by anoynmous users in Zope
    cvelistv5