GitHub Advisoryadvisory · PyPI

GHSA-p75f-g7gx-2r7p Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager

HIGH Published 2021-03-08 Modified 2024-10-21 Official page ↗
Aliases
CVE-2021-21336
Ecosystem
PyPI
Packages
Products.PluggableAuthService
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2021-03-08

Affected packages

• PyPI Products.PluggableAuthService: < 2.6.0 → fixed in 2.6.0

Description

Impact _What kind of vulnerability is it? Who is impacted?_ Information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. Patches _Has the problem been patched? What versions should users upgrade to?_ The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install "Products.PluggableAuthService>=2.6.0"` Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ There is no workaround. Users are encouraged to upgrade. References _Are there any links users can visit to find out more?_ • GHSA-p75f-g7gx-2r7p • Products.PluggableAuthService on PyPI For more information If you have any questions or comments about this advisory: • Open an issue in the Products.PluggableAuthService issue tracker • Email us at [email protected]

Related

Alias · CVE (1)

  • CVE-2021-21336 Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References