CVE-2021-33507

Advisory

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

-------------------

- Tighten down security on several login string transformation methods
(`88
<https://github.com/zopefoundation/Products.PluggableAuthService/issues/88>`_)

Resources

• https://pypi.org/project/products.pluggableauthservice
• https://pyup.io/changelogs/products.pluggableauthservice/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33507
• https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots
• http://www.openwall.com/lists/oss-security/2021/05/22/1