dcicsnovault (>=2.0.0b4 <=2.0.0b7), moksh-orchestrator (=0.2.1) potentially affected by CVE-2024-51734 via zope (=4.8.11)

zope PYPI version =4.8.11 is affected by a known vulnerability. The following packages have a transitive dependency on zope and may be impacted: - dcicsnovault =2.0.0b4, =2.0.0b7 - moksh-orchestrator =0.2.1 Source cves: CVE-2024-51734 Source advisory: OSV:GHSA-G5VW-3H65-2Q3V...

dcicsnovault (>=2.0.0b4 <=2.0.0b7), ethyca-fides (>=2.10.0 <=2.18.0) +2 more potentially affected by CVE-2024-51734 via accesscontrol (>=4.4.0 <=6.0.0)

accesscontrol PYPI version =4.4.0, =2.0.0b4, =2.10.0, =4.6.3, =4.8.11 Source cves: CVE-2024-51734 Source advisory: OSV:GHSA-G5VW-3H65-2Q3V...

CVE-2024-51734

CVE-2024-51734 affects Zope AccessControl prior to version 7.2, where anonymous users can delete data in AccessControl.userfolder.UserFolder, potentially disrupting privileged access. The issue is fixed in 7.2; a workaround is to set data__roles__ = () on the UserFolder. No exploitation details a...

CVE-2024-51734 User data deletion by anoynmous users in Zope

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to...