CVE-2021-21360 Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2021-21360?
CVE-2021-21360 is a medium-severity vulnerability in zopefoundation Products.GenericSetup, published on 9 Mar 2021.
Official description
Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `"Products.GenericSetup>=2.1.1"`.
Weakness: CWE-200
Which versions are affected by CVE-2021-21360?
3 open source packages ship an affected version, including Products.GenericSetup and products-genericsetup. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
Products.GenericSetup PyPI | All versions | 2.1.1 |
products-genericsetup PyPI | All versions | 2.1.1 |
products-genericsetup PyPI | All versions | 2.1.1 |
Products include Zope Products.genericsetup.
How do I fix CVE-2021-21360?
Upgrade Products.GenericSetup to 2.1.1 or later.
Is CVE-2021-21360 being exploited?
There is no known exploitation of CVE-2021-21360 in the wild and no public exploit code.
Sources
Also known as GHSA-jff3-mwp3-f8cw, PYSEC-2021-43.