Lucene search

GitHub_MCVE-2021-21336

HistoryMar 08, 2021 - 9:15 p.m.

CVE-2021-21336

2021-03-0821:15:16

CWE-200

GitHub_M

web.nvd.nist.gov

cve-2021-21336

pluggableauthservice

information disclosure

vulnerability

zope

authentication

authorization

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

38.0%

JSON

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do pip install "Products.PluggableAuthService>=2.6.0".

Affected configurations

Nvd

Vulners

Node

zopeproducts.pluggableauthserviceRange<2.6.0

Node

ploneploneRange4.3.0–4.3.20

ploneploneRange5.0–5.2.4

VendorProductVersionCPE
zopeproducts.pluggableauthservice*cpe:2.3:a:zope:products.pluggableauthservice:*:*:*:*:*:*:*:*
ploneplone*cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zope	products.pluggableauthservice	*	cpe:2.3:a:zope:products.pluggableauthservice::::::::
plone	plone	*	cpe:2.3:a:plone:plone::::::::

CNA Affected

[
  {
    "product": "Products.PluggableAuthService",
    "vendor": "zopefoundation",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.6.0"
      }
    ]
  }
]

References

www.openwall.com/lists/oss-security/2021/05/21/1

www.openwall.com/lists/oss-security/2021/05/22/1

github.com/zopefoundation/Products.PluggableAuthService/commit/2dad81128250cb2e5d950cddc9d3c0314a80b4bb

github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p75f-g7gx-2r7p

pypi.org/project/Products.PluggableAuthService/

Social References

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

38.0%

JSON

Related for CVE-2021-21336