URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService
CVE-2021-21337

5.7MEDIUM

Key Information:

Vendor

Zopefoundation

Status
Products.pluggableauthservice
Vendor
CVE Published:
8 March 2021

What is CVE-2021-21337?

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.1 and re-run the buildout, or if you used pip simply do `pip install "Products.PluggableAuthService>=2.6.1".

Affected Version(s)

Products.PluggableAuthService < 2.6.1

References

https://pypi.org/project/Products.PluggableAuthService/
x_refsource_MISC
https://github.com/zopefoundation/Products.PluggableAuthS...
x_refsource_CONFIRM
https://github.com/zopefoundation/Products.PluggableAuthS...
x_refsource_MISC

EPSS Score

8% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.