CVE-2021-21337GHSA-P44J-XRQG-4XRRPYSEC-2021-45
URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.6.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 on Exploit-DB
Summary
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1".
Timeline
- CVE published
- Public exploit on Exploit-DB
EDB-49930
- Record last updated
Affected versions
- zopefoundation Products.PluggableAuthService
fixed in 2.6.1
- products-pluggableauthservicePyPI
fixed in 2.6.1
- products-pluggableauthservicePyPI
fixed in 2.6.1