CVE-2021-21337

CVE-2021-21337 affects the PluggableAuthService login flow in Products.PluggableAuthService (Zope). Versions before 2.6.0 are vulnerable to an open redirect via a crafted login/redirect, e.g., altering the login flow’s came_from parameter to attacker-controlled sites. The issue is fixed in 2.6.1;...

CVE-2021-21336

CVE-2021-21336 affects the Plone/Zope component Products.PluggableAuthService. Before version 2.6.0, there is an information-disclosure vulnerability that allows listing the names of roles defined in the ZODB Role Manager plugin when the site uses this plugin. The issue has been fixed in version ...