Description: Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability – anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `”Products.GenericSetup>=2.1.1″`.
CVE-2021-21360
Published Date: 2021-03-09T01:15Z
Last Modified: 2022-01-01T18:02Z
CVSS Score: 5.3 (MEDIUM)
EPSS Score: 0.10%
Risk Score: 3.71 (MEDIUM)
Risk Score based on CVSS score and EPSS. This score is for reference purposes and is not internationally recognized.
CVSS:
5.3 |
EPSS:
0.1%
Mitre ATT&CK Technical v15.1
T1588.002 – Tool
T1053.002 – At
Technical Analysis & Mitigation Measures
Reference Links
https://pypi.org/project/Products.GenericSetup/
https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw
https://github.com/zopefoundation/Products.GenericSetup/commit/700319512b3615b3871a1f24e096cf66dc488c57
http://www.openwall.com/lists/oss-security/2021/05/21/1
http://www.openwall.com/lists/oss-security/2021/05/22/1
Vendor - Produce - Version
products.genericsetup - zope
Disclaimer
The content on this website is automatically sourced from external websites such as the National Vulnerability Database (NVD), GitHub, and other security-related sources. This content is for reference purposes only, and we are not responsible for the accuracy or integrity of the information linked or displayed from these sources.