PT-2021-14431 · Zope · Products.Pluggableauthservice

Jugmac00 + 1 · Published 2021-03-08 · Updated 2022-01-01 · CVE-2021-21337

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Products.PluggableAuthService versions prior to 2.6.1

Description The issue is an open redirect vulnerability, where a maliciously crafted link to the login form and login functionality could redirect the browser to a different website.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 by changing the buildout version pin to 2.6.1 and re-running the buildout, or by using pip install "Products.PluggableAuthService>=2.6.1".

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-21337

GHSA-P44J-XRQG-4XRR

PYSEC-2021-45

Affected Products

Products.Pluggableauthservice

References · 11

• 🔥 http://packetstormsecurity.com/files/162911/Products.PluggableAuthService-2.6.0-Open-Redirect.html · Exploit
• 🔥 https://exploit-db.com/exploits/49930 · Exploit
• https://github.com/zopefoundation/Products.PluggableAuthService/commit/7eead067898852ebd3e0f143bc51295928528dfa · Patch
• https://osv.dev/vulnerability/GHSA-p44j-xrqg-4xrr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21337 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21337 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-45 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/products-pluggableauthservice/PYSEC-2021-45.yaml · Note
• https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrr · Note
• https://github.com/zopefoundation/Products.PluggableAuthService · Note
• https://pypi.org/project/Products.PluggableAuthService · Note