$ cve CVE-2021-21337 JSON

CVE-2021-21337 EXPLOIT

5.7

MEDIUM · CVSS 3.1 · EPSS 8.4% (pctl 95)

Patch early

A public exploit exists.

Description

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1".

Scoring

CVSS	5.7 (MEDIUM, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
EPSS	8.44% — more likely to be exploited than 95% of all CVEs
Weakness	CWE-601
On CISA KEV	no
Public exploit	yes
Published	2021-03-08
Last modified	2026-06-17

Affected (1)

Vendor	Product
zope	products.pluggableauthservice

Public exploits

Source	Title	Date
exploit-db	Products.PluggableAuthService 2.6.0 - Open Redirect	2021-06-02

References

→ the Explorer · watch your stack · NVD