CVE-2024-51734: zopefoundation AccessControl, заобикаляне на вход и

Описание

Оригинално описание

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.

Засегнати продукти

• zopefoundation AccessControl: Zope AccessControl: < 7.2; Zope bundle: < 5.11.1
• zope accesscontrol: преди 7.2

Вид слабост

• CWE-284 Неправилен контрол на достъпа

История

Други уязвимости в zopefoundation AccessControl

• 6.8CVE-2026-77401
• 6.8CVE-2023-41050
• 4.4CVE-2021-32807

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-51734
• https://nvd.nist.gov/vuln/detail/CVE-2024-51734
• https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v
• https://github.com/zopefoundation/AccessControl/issues/159