Log in Start free

Vulnerability · Published Mar 9, 2021 · Assigned by GitHub_M

CVE-2021-21360Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup

Medium 5.3

In plain English

A medium-severity information exposure in Products.GenericSetup from zopefoundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.5%top 24.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `"Products.GenericSetup>=2.1.1"`.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIproducts-genericsetup2.1.1GHSA-jff3-mwp3-f8cw
PyPIproducts-genericsetup2.1.1PYSEC-2021-43

Affected products (as reported)

VendorProductVersions
zopefoundation Products.GenericSetup < 2.1.1

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References