# CVE-2021-21337: URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService

Source: https://junglewise.ai/threats/cve-2021-21337-url-redirection-to-untrusted-site-open-redirect-in-products  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-03-08  
License: CC BY 4.0 with a link back

CVE-2021-21337 · Severity: low · CVSS 3.1 · Published 2021-03-08

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1".

Technologies: [products-pluggableauthservice (PyPI)](https://junglewise.ai/threats/technologies/products-pluggableauthservice). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2021-21337 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-21337 being exploited in the wild.

**How severe is CVE-2021-21337?** Low severity, with a CVSS score of 3.1, published 8 March 2021.

**Which products and versions are affected?** products-pluggableauthservice (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.1, GIT:introduced=0,fixed=7eead067898852ebd3e0f143bc51295928528dfa|ECOSYSTEM:introduced=0,fixed=2.6.1.

**Is there a fix for CVE-2021-21337?** Yes. products-pluggableauthservice (PyPI): upgrade to 2.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2021-21337?** Check whether you run products-pluggableauthservice (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- products-pluggableauthservice (PyPI): upgrade to 2.6.1 or later

  ```sh
  pip install "products-pluggableauthservice>=2.6.1"
  ```


## Affected products

- products-pluggableauthservice (PyPI) ECOSYSTEM:introduced=0,fixed=2.6.1, GIT:introduced=0,fixed=7eead067898852ebd3e0f143bc51295928528dfa|ECOSYSTEM:introduced=0,fixed=2.6.1

## Identifiers

- CVE-2021-21337
- GHSA-p44j-xrqg-4xrr
- PYSEC-2021-45

## Related threats

- [PYSEC-2026-2967 - Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone](https://junglewise.ai/threats/cve-2021-33507-plone-reflected-cross-site-scripting-vulnerability)
- [Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager](https://junglewise.ai/threats/cve-2021-21336-exposure-of-sensitive-information-to-an-unauthorized-actor-in)