Log in Start free

Vulnerability · Published Mar 8, 2021 · Assigned by GitHub_M

CVE-2021-21336Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager

Medium 6.5

In plain English

A medium-severity information exposure in Products.PluggableAuthService from zopefoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.5%top 25.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install "Products.PluggableAuthService>=2.6.0"`.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIproducts-pluggableauthservice2.6.0GHSA-p75f-g7gx-2r7p
PyPIproducts-pluggableauthservice2.6.0PYSEC-2021-44

Affected products (as reported)

VendorProductVersions
zopefoundation Products.PluggableAuthService < 2.6.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References