CVE-2021-21360

Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `"Products.GenericSetup>=2.1.1"`.

• CWE-200

• http://www.openwall.com/lists/oss-security/2021/05/21/1Mailing List
• http://www.openwall.com/lists/oss-security/2021/05/22/1Mailing List
• https://github.com/zopefoundation/Products.GenericSetup/commit/700319512b3615b3871a1f24e096cf66dc488c57Patch, Third Party Advisory
• https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cwThird Party Advisory
• https://pypi.org/project/Products.GenericSetup/Product, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/21/1Mailing List
• http://www.openwall.com/lists/oss-security/2021/05/22/1Mailing List
• https://github.com/zopefoundation/Products.GenericSetup/commit/700319512b3615b3871a1f24e096cf66dc488c57Patch, Third Party Advisory
• https://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cwThird Party Advisory
• https://pypi.org/project/Products.GenericSetup/Product, Third Party Advisory

Published

Mar 9, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21354Pollbot is open source software which "frees its human maste…6.1
• CVE-2021-21355TYPO3 is an open source PHP based web content management sys…8.6
• CVE-2021-21357TYPO3 is an open source PHP based web content management sys…8.3
• CVE-2021-21358TYPO3 is an open source PHP based web content management sys…5.4
• CVE-2021-21359TYPO3 is an open source PHP based web content management sys…7.5
• CVE-2021-2136Vulnerability in the Oracle WebLogic Server product of Oracl…9.8
• CVE-2021-21361The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin conta…6.5
• CVE-2021-21362MinIO is an open-source high performance object storage serv…6.5
• CVE-2021-21363swagger-codegen is an open-source project which contains a t…7
• CVE-2021-21364swagger-codegen is an open-source project which contains a t…5.5
• CVE-2021-21365Bootstrap Package is a theme for TYPO3. It has been discover…5.4
• CVE-2021-21366xmldom is a pure JavaScript W3C standard-based (XML DOM Leve…4.3