Description (CNA)
Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to upgrade. Users unable to upgrade may address the issue by adding `data__roles__ = ()` to `AccessControl.userfolder.UserFolder`.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| zopefoundation / AccessControl | affected Zope AccessControl: < 7.2; affected Zope bundle: < 5.11.1 |
CWE
CWE-284
References
- https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-g5vw-3h65-2q3v
- https://github.com/zopefoundation/AccessControl/issues/159
ADP enrichment
No English description supplied.
No references supplied.