MEDIUM6.1

PYSEC-2026-2967

Cross-site scripting in Products.CMFCore, Products.PluggableAuthService, Plone

Quick fix

PYSEC-2026-2967 — products-pluggableauthservice: upgrade to the fixed version with the command below.

pip install --upgrade 'products-pluggableauthservice>=2.6.2'

Details

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/products-pluggableauthservice

Introduced in: 0Fixed in: 2.6.2

Fixpip install --upgrade 'products-pluggableauthservice>=2.6.2'

References

https://nvd.nist.gov/vuln/detail/CVE-2021-33507[ADVISORY]
https://github.com/advisories/GHSA-35rg-466w-77h3[ADVISORY]
https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2021-79.yaml[WEB]
https://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots[WEB]
http://www.openwall.com/lists/oss-security/2021/05/22/1[WEB]
https://pypi.org/project/products-pluggableauthservice[PACKAGE]