CVE-2024-51734: falha de alta gravidade em zopefoundation AccessControl
User data deletion by anoynmous users in Zope
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.4%
Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Produtos afetados
zopefoundation · AccessControlCVEs relacionadas — zopefoundation AccessControl
No mesmo produto, das mais perigosas para as menos.
CVE-2021-32807MEDIUMRemote Code Execution via unsafe classes in otherwise permitted modulesEPSS 2.1%CVE-2023-41050MEDIUMInformation disclosure through Python's "format" functionality in Zope AccessControlEPSS 0.6%CVE-2026-77401MEDIUMZope AccessControl: Information disclosure through Python string `format` and `format_map` functionsEPSS 0.5%