Detections
Analytics

SCA: security update for AccessControl, zope (GHSA-qcx9-j53g-ccgf)

medium Tenable Self-Hosted Container Security Plugin ID 418074

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The module `AccessControl` defines security policies for Python code used in restricted code within Zope
 applications. Restricted code is any code that resides in Zope's object database, such as the contents of
 `Script (Python)` objects. The policies defined in `AccessControl` severely restrict access to Python
 modules and only exempt a few that are deemed safe, such as Python's `string` module. However, full access
 to the `string` module also allows access to the class `Formatter`, which can be overridden and extended
 within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe
 Python libraries can be used for remote code execution. By default, you need to have the admin-level Zope
 "Manager" role to add or edit `Script (Python)` objects through the web. Only sites that allow untrusted
 users to add/edit these scripts through the web - which would be a very unusual configuration to begin
 with - are at risk. The problem has been fixed in AccessControl 4.3 and 5.2. Only AccessControl versions 4
 and 5 are vulnerable, and only on Python 3, not Python 2.7. As a workaround, a site administrator can
 restrict adding/editing `Script (Python)` objects through the web using the standard Zope user/role
 permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing
 these scripts through the web should be restricted to trusted users only. This is the default
 configuration in Zope. (CVE-2021-32807)

Solution

Update the AccessControl library and its related packages to version 4.3 or later.

See Also

https://github.com/advisories/GHSA-qcx9-j53g-ccgf

Plugin Details

Severity: Medium

ID: 418074

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.12

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS Score Source: CVE-2021-32807

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.9

Threat Score: 2

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/5/2021

Vulnerability Publication Date: 7/30/2021

Reference Information

CVE: CVE-2021-32807