CVSS: 8.7EPSS: 0%CPEs: 2EXPL: 0CVE-2024-51734 – User data deletion by anoynmous users in Zope
https://notcve.org/view.php?id=CVE-2024-51734
04 Nov 2024 — Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`. • https://github.com/zopefoundation/AccessControl/issues/159 • CWE-284: Improper Access Control •
CVSS: 7.7EPSS: 0%CPEs: 5EXPL: 0CVE-2023-41050 – Information disclosure through Python's "format" functionality in Zope AccessControl
https://notcve.org/view.php?id=CVE-2023-41050
06 Sep 2023 — AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. `AccessControl` already provides a saf... • https://github.com/zopefoundation/AccessControl/commit/6bc32692e0d4b8d5cf64eae3d19de987c7375bc9 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •