CVE-2021-21337: URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService

CVE-2021-21337 · Severity: low · CVSS 3.1 · Published 2021-03-08

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1".

Technologies: products-pluggableauthservice (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-21337 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-21337 being exploited in the wild.
How severe is CVE-2021-21337?
Low severity, with a CVSS score of 3.1, published 8 March 2021.
Which products and versions are affected?
products-pluggableauthservice (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.1, GIT:introduced=0,fixed=7eead067898852ebd3e0f143bc51295928528dfa|ECOSYSTEM:introduced=0,fixed=2.6.1.
Is there a fix for CVE-2021-21337?
Yes. products-pluggableauthservice (PyPI): upgrade to 2.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2021-21337?
Check whether you run products-pluggableauthservice (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • products-pluggableauthservice (PyPI): upgrade to 2.6.1 or later
    pip install "products-pluggableauthservice>=2.6.1"

Affected products

  • products-pluggableauthservice (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.1, GIT:introduced=0,fixed=7eead067898852ebd3e0f143bc51295928528dfa|ECOSYSTEM:introduced=0,fixed=2.6.1

Identifiers

  • CVE-2021-21337
  • GHSA-p44j-xrqg-4xrr
  • PYSEC-2021-45

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.