CVE-2024-51734 User data deletion by anoynmous users in Zope
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-51734?
CVE-2024-51734 is a high-severity vulnerability in zopefoundation AccessControl, published on 4 Nov 2024.
Official description
Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.
Weakness: CWE-284
Which versions are affected by CVE-2024-51734?
6 open source packages ship an affected version, including accesscontrol, AccessControl and Zope.
| Package | Affected | Fixed in |
|---|---|---|
accesscontrol PyPI | All versions | 7.2 |
accesscontrol PyPI | All versions | 7.2 |
AccessControl PyPI | All versions | 7.2 |
Zope PyPI | All versions | 5.11.1 |
zope PyPI | All versions | 5.11.1 |
zope PyPI | All versions | 5.11.1 |
How do I fix CVE-2024-51734?
Upgrade accesscontrol to 7.2 or later.
Is CVE-2024-51734 being exploited?
There is no known exploitation of CVE-2024-51734 in the wild and no public exploit code.
Sources
Also known as GHSA-g5vw-3h65-2q3v, PYSEC-2026-2076, PYSEC-2026-2326.