Access Restriction Bypass Affecting products.pluggableauthservice package, versions [,2.6.2)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-PRODUCTSPLUGGABLEAUTHSERVICE-1090197
- published 1 Apr 2021
- disclosed 1 Apr 2021
- credit Unknown
How to fix?
Upgrade Products.PluggableAuthService to version 2.6.2 or higher.
Overview
Products.PluggableAuthService is a Pluggable Zope authentication / authorization framework
Affected versions of this package are vulnerable to Access Restriction Bypass. Multiple login string transformation methods are set to public which could lead to Access Control issues. The vulnerability is likely not exploitable.
References
CVSS Scores
version 3.1