CVE-2021-21360 : Products.GenericSetup is a mini-framework for expressing the configured state of

Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `"Products.GenericSetup>=2.1.1"`.

Published 2021-03-09 01:15:13

Updated 2022-01-01 18:02:35

Source GitHub, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2021-21360

Zope » Products.genericsetup
Versions before (<) 2.1.1
cpe:2.3:a:zope:products.genericsetup:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2021-21360

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 41 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-21360

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	GitHub, Inc.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2021-21360

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: security-advisories@github.com (Primary)

References for CVE-2021-21360

https://github.com/zopefoundation/Products.GenericSetup/commit/700319512b3615b3871a1f24e096cf66dc488c57

Enforce access control on snapshot files and folders. · zopefoundation/Products.GenericSetup@7003195 · GitHub
Patch;Third Party Advisory
https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw

Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup · Advisory · zopefoundation/Products.GenericSetup · GitHub
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/22/1

oss-security - Re: Plone security hotfix 20210518
Mailing List

CVEs referencing this url
https://pypi.org/project/Products.GenericSetup/

Products.GenericSetup · PyPI
Product;Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/21/1

oss-security - Plone security hotfix 20210518
Mailing List

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-21360

Products affected by CVE-2021-21360

Exploit prediction scoring system (EPSS) score for CVE-2021-21360

CVSS scores for CVE-2021-21360

CWE ids for CVE-2021-21360

References for CVE-2021-21360