High severity · published May 21, 2021
CVE-2021-32633
Zope is an open-source web application server
8.8
CVSS
1.9%
EPSS
No
On KEV
Description
Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PL
Plone · Plone
through 4.3.20; 5.0 through 5.2.4 · source: NVD
ZO
Zope · Zope
before 4.6; 5.0 before 5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-32633
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-32633
Mailing List
http://www.openwall.com/lists/oss-security/2021/05/21/1
Mailing List
http://www.openwall.com/lists/oss-security/2021/05/22/1
Exploit
https://cyllective.com/blog/post/plone-authenticated-rce-cve-2021-32633/
Patch
https://github.com/zopefoundation/Zope/commit/1f8456bf1f908ea46012537d52bd7e752a532c91
Third Party Advisory
https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36
More from Plone
9.9
CVE-2021-33509
Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script
9.8
CVE-2020-35190
The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user
9.8
CVE-2020-7941
A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission
8.8
CVE-2021-33926
An issue in Plone CMS v
8.8
CVE-2020-28736
Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager…