CVE-2021-21336

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install "Products.PluggableAuthService>=2.6.0"`.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
zopefoundation	Products.PluggableAuthService	< 2.6.0

References

http://www.openwall.com/lists/oss-security/2021/05/21/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/22/1Mailing List, Third Party Advisory
https://github.com/zopefoundation/Products.PluggableAuthService/commit/2dad81128250cb2e5d950cddc9d3c0314a80b4bbPatch, Third Party Advisory
https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p75f-g7gx-2r7pThird Party Advisory
https://pypi.org/project/Products.PluggableAuthService/Product, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/21/1Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/22/1Mailing List, Third Party Advisory
https://github.com/zopefoundation/Products.PluggableAuthService/commit/2dad81128250cb2e5d950cddc9d3c0314a80b4bbPatch, Third Party Advisory
https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p75f-g7gx-2r7pThird Party Advisory
https://pypi.org/project/Products.PluggableAuthService/Product, Third Party Advisory

Timeline

Published: Mar 8, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-213376.1Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before versio CVE-2021-213386.1TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it CVE-2021-213397.5TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 us CVE-2021-21346.5Vulnerability in the Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: FMW Control Plugin). The supp CVE-2021-213405.4TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that databa CVE-2021-213417.5XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may all CVE-2021-213429.1XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the p CVE-2021-213437.5XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability where the p CVE-2021-213449.8XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may a CVE-2021-213459.9XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may a CVE-2021-213469.8XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may a CVE-2021-213479.8XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may a