PT-2021-14443 · Unknown · Products.Genericsetup

Dataflake · Published 2021-03-09 · Updated 2022-01-01 · CVE-2021-21360

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Products.GenericSetup versions prior to 2.1.1

Description The issue is an information disclosure vulnerability where anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. This problem has been fixed in version 2.1.1.

Recommendations For versions prior to 2.1.1, change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip, simply do pip install "Products.GenericSetup>=2.1.1". As a temporary workaround, visit the ZMI Security tab at portal setup/manage access and click on the link Access contents information. On the next page, uncheck the box Also use roles acquired from folders containing this objects at the bottom and check the boxes for Manager and Owner. Then click on Save Changes. Return to the ZMI Security tab at portal setup/manage access and scroll down to the link View. Click on View, uncheck the box Also use roles acquired from folders containing this objects at the bottom and check the boxes for Manager and Owner. Then click on Save Changes.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2021-21360

GHSA-JFF3-MWP3-F8CW

PYSEC-2021-43

Affected Products

Products.Genericsetup

References · 14

• https://github.com/zopefoundation/Products.GenericSetup/commit/700319512b3615b3871a1f24e096cf66dc488c57 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-21360 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21360 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-43 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jff3-mwp3-f8cw · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/products-genericsetup/PYSEC-2021-43.yaml · Note
• https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw · Note
• https://github.com/zopefoundation/Products.GenericSetup · Note
• https://t.me/cibsecurity/24583 · Telegram Post
• https://pypi.org/project/Products.GenericSetup · Note
• http://openwall.com/lists/oss-security/2021/05/21/1 · Note
• https://t.me/cvenotify/14887 · Telegram Post
• https://t.me/cvenotify/11014 · Telegram Post
• http://openwall.com/lists/oss-security/2021/05/22/1 · Note