PT-2024-34872 · Zope · Zope Accesscontrol

N1K9 · Published 2024-11-04 · Updated 2025-01-22 · CVE-2024-51734

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions Zope AccessControl versions prior to 7.2

Description The issue allows anonymous users to delete the user data maintained by an AccessControl.userfolder.UserFolder, which may prevent any privileged access.

Recommendations For versions prior to 7.2, upgrade to version 7.2 to resolve the issue. As a temporary workaround for users unable to upgrade, add data roles = () to AccessControl.userfolder.UserFolder.

Exploit

Fix

Improper Access Control

Improper Privilege Management

Weakness Enumeration

CWE-284

CWE-269

Related Identifiers

CVE-2024-51734

GHSA-G5VW-3H65-2Q3V

Affected Products

Zope Accesscontrol

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51734.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-51734 · Security Note
• https://osv.dev/vulnerability/CVE-2024-51734 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g5vw-3h65-2q3v · Vendor Advisory
• https://github.com/zopefoundation/AccessControl/issues/159 · Note
• https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v · Note
• https://github.com/zopefoundation/AccessControl · Note
• https://twitter.com/CveFindCom/status/1853573126363271222 · Twitter Post
• https://twitter.com/CVEnew/status/1853568295389278533 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1853704803064373507 · Twitter Post
• https://t.me/cvedetector/9792 · Telegram Post