GHSA-g5vw-3h65-2q3v

Suggest an improvement
Source
https://github.com/advisories/GHSA-g5vw-3h65-2q3v
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-g5vw-3h65-2q3v/GHSA-g5vw-3h65-2q3v.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-g5vw-3h65-2q3v
Aliases
Published
2024-11-04T23:23:35Z
Modified
2026-07-13T16:43:09.124567216Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
  • 6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator
Summary
Access control vulnerable to user data deletion by anonynmous users
Details

Impact

Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access.

Patches

The problem is fixed in version 7.2.

Workarounds

The problem can be fixed by adding data__roles__ = () to AccessControl.userfolder.UserFolder.

References

https://github.com/zopefoundation/AccessControl/issues/159

Database specific 
{
    "cwe_ids": [
        "CWE-269",
        "CWE-284"
    ],
    "github_reviewed": true,
    "nvd_published_at": "2024-11-04T23:15:05Z",
    "severity": "MODERATE",
    "github_reviewed_at": "2024-11-04T23:23:35Z"
}
References

Affected packages

PyPI / accesscontrol

Package

Name
accesscontrol
View open source insights on deps.dev
Purl
pkg:pypi/accesscontrol

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
7.2

Affected versions

2.*
2.13.0
2.13.1
2.13.2
2.13.3
2.13.4
2.13.5
2.13.6
2.13.7
2.13.8
2.13.9
2.13.10
2.13.11
2.13.12
2.13.13
2.13.14
2.13.15
2.13.16
3.*
3.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
4.*
4.0a1
4.0a2
4.0a3
4.0a4
4.0a5
4.0a6
4.0a7
4.0b1
4.0b2
4.0b3
4.0b4
4.0b5
4.0b6
4.0b7
4.0
4.1
4.2
4.3
4.4
5.*
5.0
5.1
5.2
5.3
5.3.1
5.4
5.5
5.6
5.7
6.*
6.0
6.1
6.2
6.3
7.*
7.0
7.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-g5vw-3h65-2q3v/GHSA-g5vw-3h65-2q3v.json"

PyPI / zope

Package

Name
zope
View open source insights on deps.dev
Purl
pkg:pypi/zope

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.11.1

Affected versions

4.*
4.0b1
4.0b2
4.0b3
4.0b4
4.0b5
4.0b6
4.0b7
4.0b8
4.0b9
4.0b10
4.0
4.1
4.1.1
4.1.2
4.1.3
4.2
4.2.1
4.3
4.4
4.4.1
4.4.2
4.4.3
4.4.4
4.5
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.6
4.6.1
4.6.2
4.6.3
4.7
4.8
4.8.1
4.8.2
4.8.3
4.8.4
4.8.5
4.8.6
4.8.7
4.8.8
4.8.9
4.8.10
4.8.11
5.*
5.0a1
5.0a2
5.0
5.1
5.1.1
5.1.2
5.2
5.2.1
5.3
5.4
5.5
5.5.1
5.5.2
5.6
5.7
5.7.1
5.7.2
5.7.3
5.8
5.8.1
5.8.2
5.8.3
5.8.4
5.8.5
5.8.6
5.9
5.10
5.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-g5vw-3h65-2q3v/GHSA-g5vw-3h65-2q3v.json"