CVE-2021-32633

    Dashboard / Vulnerabilities / CVE-2021-32633

    CVE-2021-32633

    Published: 21 May 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

    References: http://www.openwall.com/lists/oss-security/2021/05/21/1, http://www.openwall.com/lists/oss-security/2021/05/22/1, https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36, https://github.com/zopefoundation/Zope/commit/1f8456bf1f908ea46012537d52bd7e752a532c91, https://cyllective.com/blog/post/plone-authenticated-rce-cve-2021-32633/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    5.2.4
    5.2.3
    5.2.2
    5.2.1
    5.2.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32633 | CVE-DB