AccessControl vulnerabilities

2 known vulnerabilities in AccessControl from Zopefoundation. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  AccessControl: Improper Access Control

  CVE-2024-51734Nov 4, 2024Zopefoundation

  Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an `AccessControl.userfolder.UserFolder` which may prevent any privileged access. This problem has been fixed

• 7.7 High severity

  AccessControl: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2023-41050Sep 6, 2023Zopefoundation

  AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those at