{"id":"CVE-2021-21336","aliases":["GHSA-p75f-g7gx-2r7p","PYSEC-2021-44"],"title":"Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager","summary":"Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManager","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","vendor":"products-pluggableauthservice","product":"products-pluggableauthservice","ecosystem":"pip","affected":["products-pluggableauthservice < 2.6.0"],"patched":["products-pluggableauthservice 2.6.0"],"published":"2021-03-08","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-p75f-g7gx-2r7p","references":[{"url":"https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p75f-g7gx-2r7p"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21336"},{"url":"https://github.com/zopefoundation/Products.PluggableAuthService/commit/2dad81128250cb2e5d950cddc9d3c0314a80b4bb"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/products-pluggableauthservice/PYSEC-2021-44.yaml"},{"url":"https://github.com/zopefoundation/Products.PluggableAuthService"},{"url":"https://pypi.org/project/Products.PluggableAuthService"},{"url":"http://www.openwall.com/lists/oss-security/2021/05/21/1"},{"url":"http://www.openwall.com/lists/oss-security/2021/05/22/1"}],"tags":["osv","pip"],"epss":0.01499,"epssPercentile":0.73162,"ingestedAt":"2026-07-08T18:25:51.720Z","slug":"CVE-2021-21336","body":"## Overview\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nInformation disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nThe problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install \"Products.PluggableAuthService>=2.6.0\"`\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThere is no workaround. Users are encouraged to upgrade.\n\n### References\n_Are there any links users can visit to find out more?_\n\n- [GHSA-p75f-g7gx-2r7p](https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p75f-g7gx-2r7p)\n- [Products.PluggableAuthService on PyPI](https://github.com/zopefoundation/Products.PluggableAuthService)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in the [Products.PluggableAuthService issue tracker](https://github.com/zopefoundation/Products.PluggableAuthService/issues)\n* Email us at [security@plone.org](mailto:security@plone.org)\n\n## Affected packages\n\n- `products-pluggableauthservice < 2.6.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `products-pluggableauthservice 2.6.0`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}