high8.7
CVE-2024-51734
Access control vulnerable to user data deletion by anonynmous users
Impact
### Impact Anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. ### Patches The problem is fixed in version 7.2. ### Workarounds The problem can be fixed by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`. ### References https://github.com/zopefoundation/AccessControl/issues/159
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | AccessControl | < 7.2 | 7.2 |
| pip | Zope | < 5.11.1 | 5.11.1 |