zopefoundation/accesscontrol · Security
Access control vulnerable to user data deletion by anonynmous users
- GHSA ID
- GHSA-g5vw-3h65-2q3v
- CVE ID
- CVE-2024-51734
- Severity
- medium
- Published
- Updated
- CVSS
- 9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- CVSS v3
- 9.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- CVSS v4
- 6.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Description
Impact
Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access.
Patches
The problem is fixed in version 7.2.
Workarounds
The problem can be fixed by adding data__roles__ = () to AccessControl.userfolder.UserFolder.
References
CWEs
- CWE-269 · Improper Privilege Management
- CWE-284 · Improper Access Control