CVE-2024-51734

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-51734

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51734.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-51734

Aliases

Published

2024-11-04T22:25:22.076Z

Modified

2026-08-12T03:51:45.180044174Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

User data deletion by anoynmous users in Zope

Details

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding data__roles__ = () to AccessControl.userfolder.UserFolder.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/51xxx/CVE-2024-51734.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "Zope bundle:  < 5.11.1"
                },
                {
                    "last_affected": "Zope bundle:  < 5.11.1"
                }
            ]
        }
    ],
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284"
    ]
}

References

Affected packages

Git / github.com/zopefoundation/accesscontrol

Affected ranges

Type

GIT

Repo

https://github.com/zopefoundation/accesscontrol

Events

Introduced

81dcf3d284964e468f8eba32224863ed47033170

Last affected

81dcf3d284964e468f8eba32224863ed47033170

Database specific

Show details

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "Zope AccessControl: < 7.2"
        },
        {
            "last_affected": "Zope AccessControl: < 7.2"
        }
    ]
}

Affected versions

7.*

7.2

Zope AccessControl: < 7.*

Zope AccessControl: < 7.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-51734.json"