Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetup
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `"Products.GenericSetup>=2.1.1"`.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zopefoundation | Products.GenericSetup | before 2.1.1 | 2.1.1 | Patch available | CNA |
| — | Products.GenericSetup (PyPI) | before 2.1.1 | 2.1.1 | Patch available | GHSA-jff3-mwp3-f8cw |
- Products.GenericSetup Vendorzopefoundation Affected before 2.1.1 Fixed in 2.1.1 Patch available CNA
- Products.GenericSetup (PyPI) Vendor— Affected before 2.1.1 Fixed in 2.1.1 Patch available GHSA-jff3-mwp3-f8cw
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zope:products.genericsetup:*:*:*:*:*:*:*:* | before 2.1.1 | Vulnerable | zopefoundation |
- cpe:2.3:a:zope:products.genericsetup:*:*:*:*:*:*:*:* Versions before 2.1.1 Vulnerable ·zopefoundation
Remediation
- Fix · CNA Products.GenericSetup (zopefoundation) Fixed in 2.1.1
- Fix · GHSA-jff3-mwp3-f8cw Products.GenericSetup (PyPI) Fixed in 2.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-21360
- 2026-10-03 Alias added: GHSA-jff3-mwp3-f8cw
References
Advisory 3
Other 5
- [oss-security] 20210521 Plone security hotfix 20210518
- [oss-security] 20210522 Re: Plone security hotfix 20210518
- https://github.com/pypa/advisory-database/tree/main/vulns/products-genericsetup/PYSEC-2021-43.yaml
- https://github.com/zopefoundation/Products.GenericSetup
- https://pypi.org/project/Products.GenericSetup
Sources
- CVE-2021-21360 · CVE Program
- CVE-2021-21360 · NVD
- FIRST EPSS
- GHSA-jff3-mwp3-f8cw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences