CVE-2021-21337 URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthService

What is CVE-2021-21337?

CVE-2021-21337 is a medium-severity vulnerability in zopefoundation Products.PluggableAuthService, published on 8 Mar 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1".

Weakness: CWE-601

Which versions are affected by CVE-2021-21337?

3 open source packages ship an affected version, including Products.PluggableAuthService and products-pluggableauthservice. It affects 1 product.

Products include Zope Products.pluggableauthservice.

How do I fix CVE-2021-21337?

Upgrade Products.PluggableAuthService to 2.6.1 or later.

Is CVE-2021-21337 being exploited?

There is no known exploitation of CVE-2021-21337 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p44j-xrqg-4xrr, PYSEC-2021-45.