CVE-2021-21360: Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup
First published: Tue Mar 09 2021(Updated: )
### Impact _What kind of vulnerability is it? Who is impacted?_ Information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. ### Patches _Has the problem been patched? What versions should users upgrade to?_ The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `"Products.GenericSetup>=2.1.1"` ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Visit the ZMI Security tab at `portal_setup/manage_access` and click on the link _Access contents information_. On the next page, uncheck the box _Also use roles acquired from folders containing this objects_ at the bottom and check the boxes for _Manager_ and _Owner_. Then click on _Save Changes_. Return to the ZMI Security tab at `portal_setup/manage_access` and scroll down to the link _View_. Click on _View_, uncheck the box _Also use roles acquired from folders containing this objects_ at the bottom and check the boxes for _Manager_ and _Owner_. Then click on _Save Changes_. ### References _Are there any links users can visit to find out more?_ - [GHSA-jff3-mwp3-f8cw](https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw) - [Products.GenericSetup on PyPI](https://pypi.org/project/Products.GenericSetup/) - [Definition of information disclosure at MITRE](https://cwe.mitre.org/data/definitions/200.html) ### For more information If you have any questions or comments about this advisory: * Open an issue in the [Products.GenericSetup issue tracker](https://github.com/zopefoundation/Products.GenericSetup/issues) * Email us at [security@plone.org](mailto:security@plone.org)
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zope Products.genericsetup | <2.1.1 | |
| pip/Products.GenericSetup | <2.1.1 | 2.1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2021/05/21/1
- http://www.openwall.com/lists/oss-security/2021/05/22/1
- https://github.com/zopefoundation/Products.GenericSetup/commit/700319512b3615b3871a1f24e096cf66dc488c57
- https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw
- https://pypi.org/project/Products.GenericSetup/
- https://nvd.nist.gov/vuln/detail/CVE-2021-21360
- https://github.com/pypa/advisory-database/tree/main/vulns/products-genericsetup/PYSEC-2021-43.yaml
- https://pypi.org/project/Products.GenericSetup
- https://github.com/advisories/GHSA-jff3-mwp3-f8cw (Advisory)
Frequently Asked Questions
What is CVE-2021-21360?
CVE-2021-21360 is an information disclosure vulnerability in Products.GenericSetup.
How does CVE-2021-21360 affect Zope Products.genericsetup?
CVE-2021-21360 affects Zope Products.genericsetup version up to 2.1.1.
What is the severity of CVE-2021-21360?
CVE-2021-21360 has a severity of medium with a CVSS score of 5.3.
How can anonymous visitors exploit CVE-2021-21360?
Anonymous visitors can exploit CVE-2021-21360 to view log and snapshot files generated by the GenericSetup framework.
Is there a fix available for CVE-2021-21360?
Yes, the fix for CVE-2021-21360 is available in Products.GenericSetup version 2.1.1.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/severity
- agent/title
- agent/weakness
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-jff3-mwp3-f8cw
- alias/CVE-2021-21360
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/zope
- canonical/zope products.genericsetup
- package-manager/pip