CVE-2024-51734 - CVE House

Back to Database

Status published High CVE-2024-51734

User data deletion by anoynmous users in Zope

8.7 CVSS

Vulnerability Description

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-51734

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from zopefoundation

View All →

try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter

RestrictedPython information leakage via `AttributeError.obj` and the `string` module

Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution

Zope management interface vulnerable to stored cross site scripting via the title property

Zope vulnerable to Stored Cross Site Scripting with SVG images

Affected Vendor

zopefoundation

View all reports →

Affected Software

AccessControl

Vulnerable Versions:

Zope AccessControl: < 7.2, Zope bundle: < 5.11.1

Timeline

Official Publish: November 4th, 2024

Last Modified: January 22nd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation