CVE-2021-21360

{"id": "CVE-2021-21360", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2021-03-09T01:15:13.120", "references": [{"url": "http://www.openwall.com/lists/oss-security/2021/05/21/1", "tags": ["Mailing List"], "source": "security-advisories@github.com"}, {"url": "http://www.openwall.com/lists/oss-security/2021/05/22/1", "tags": ["Mailing List"], "source": "security-advisories@github.com"}, {"url": "https://github.com/zopefoundation/Products.GenericSetup/commit/700319512b3615b3871a1f24e096cf66dc488c57", "tags": ["Patch", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "https://pypi.org/project/Products.GenericSetup/", "tags": ["Product", "Third Party Advisory"], "source": "security-advisories@github.com"}, {"url": "http://www.openwall.com/lists/oss-security/2021/05/21/1", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2021/05/22/1", "tags": ["Mailing List"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/zopefoundation/Products.GenericSetup/commit/700319512b3615b3871a1f24e096cf66dc488c57", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://pypi.org/project/Products.GenericSetup/", "tags": ["Product", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `\"Products.GenericSetup>=2.1.1\"`."}, {"lang": "es", "value": "Products.GenericSetup es un mini framework para expresar el estado configurado de un sitio Zope como un conjunto de artefactos del sistema de archivos. En Products.GenericSetup anterior a versi\u00f3n 2.1.1, se presenta una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n: los visitantes an\u00f3nimos pueden visualizar archivos de registro e instant\u00e1neas generadas por la Generic Setup Tool. El problema se ha corregido en la versi\u00f3n 2.1.1. Dependiendo de c\u00f3mo haya instalado Products.GenericSetup, debe cambiar el pin de la versi\u00f3n de compilaci\u00f3n a 2.1.1 y volver a ejecutar la compilaci\u00f3n, o si us\u00f3 pip simplemente haga la instalaci\u00f3n de pip \"Products.GenericSetup versiones posteriores o iguales a 2.1.1\"`"}], "lastModified": "2024-11-21T05:48:11.760", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zope:products.genericsetup:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "344C85D3-5FB3-4860-B4EC-881E1DC94A20", "versionEndExcluding": "2.1.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}