Medium severity · published Mar 9, 2021
CVE-2021-21360
Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts
5.3
CVSS
1.5%
EPSS
No
On KEV
Description
Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `"Products.GenericSetup>=2.1.1"`.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Products.genericsetup · Zope
before 2.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-21360
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-21360
Mailing List
http://www.openwall.com/lists/oss-security/2021/05/21/1
Mailing List
http://www.openwall.com/lists/oss-security/2021/05/22/1
Patch
https://github.com/zopefoundation/Products.GenericSetup/commit/700319512b3615b3871a1f24e096cf66dc488c57
Third Party Advisory
https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw
Product
https://pypi.org/project/Products.GenericSetup/