CVE-2021-21337

MEDIUM

Zope Products.pluggableauthservice < 2.6.1 - Open Redirect

Title source: rule

Description

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1".

Exploits (1)

exploitdb WORKING POC

by Piyush Patil · textwebappspython

https://www.exploit-db.com/exploits/49930

View Code ZIP pw:eip

References (4)

[Exploit, Third Party Advisory, VDB Entry] http://packetstormsecurity.com/files/162911/Products.PluggableAuthService-2.6.0-Open-Redirect.html

[Patch, Third Party Advisory] https://github.com/zopefoundation/Products.PluggableAuthService/commit/7eead067898852ebd3e0f143bc51295928528dfa

[Third Party Advisory] https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrr

[Product, Third Party Advisory] https://pypi.org/project/Products.PluggableAuthService/

Scores

CVSS v3 5.7

EPSS 0.0180

EPSS Percentile 82.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Details

CWE

CWE-601

Status published

Products (2)

pypi/Products.PluggableAuthService 0 - 2.6.1PyPI

zope/products.pluggableauthservice < 2.6.1

Published Mar 08, 2021

Tracked Since Feb 18, 2026