CVE-2021-21336: Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager
Vulnerability summary
CVE-2021-21336 is a medium (CVSS 6.5) vulnerability in plone. EPSS estimates a 1.50% chance of exploitation in the next 30 days, higher than 74.2% of scored vulnerabilities.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 08-03-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install "Products.PluggableAuthService>=2.6.0"`.
CVSS metrics
5 scores · 3 sources · 3 versions- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.50%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.50% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Plone1 product
- plone≥ 4.3.0, ≤ 4.3.20 | ≥ 5.0, ≤ 5.2.4
PyPI1 product
- products-pluggableauthservice< 2dad81128250cb2e5d950cddc9d3c0314a80b4bb | < 2.6.0
Zope1 product
Zopefoundation1 product
4 vendors · 4 products
References
9 links- github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p75f-g7gx-2r7pX Refsource CONFIRMWEBAdvisoryThird Party Advisory
- www.openwall.com/lists/oss-security/2021/05/21/1Mailing ListX Refsource MLISTWEBThird Party Advisory
- www.openwall.com/lists/oss-security/2021/05/22/1Mailing ListX Refsource MLISTWEBThird Party Advisory
