PT-2021-20164 · Zope · Products.Pluggableauthservice+1

Calum Hutton · Published 2021-05-21 · Updated 2021-06-18 · CVE-2021-33507

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zope Products.CMFCore versions prior to 2.5.1 Zope Products.PluggableAuthService versions prior to 2.6.2 Plone versions prior to 5.2.4

Description The issue allows Reflected XSS. This means an attacker can inject malicious code into a website, which will then be executed by the user's browser. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For Zope Products.CMFCore versions prior to 2.5.1, update to version 2.5.1 or later. For Zope Products.PluggableAuthService versions prior to 2.6.2, update to version 2.6.2 or later. For Plone versions prior to 5.2.4, update to version 5.2.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-33507

GHSA-35RG-466W-77H3

PYSEC-2021-79

Affected Products

Zope Products.Cmfcore

Products.Pluggableauthservice

References · 10

• https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33507 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-79 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33507 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-35rg-466w-77h3 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-79.yaml · Note
• https://t.me/cvenotify/14896 · Telegram Post
• https://t.me/cvenotify/14854 · Telegram Post
• https://github.com/advisories/GHSA-35rg-466w-77h3 · Note
• http://openwall.com/lists/oss-security/2021/05/22/1 · Note