{"uuid": "cb26a79c-5c6e-4542-a049-e615af091426", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21337", "type": "seen", "source": "https://t.me/hacking_Attack/11108", "content": "Exploit Collector\nProducts.PluggableAuthService 2.6.0 Open Redirect\n\nhttps://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png \nProducts.PluggableAuthService version 2.6.0 suffers from an open redirection vulnerability.\n\nMD5 | 4b70535ef74ac82dc36e19572d6af760\n\nDownload\n# Exploit Title: Products.PluggableAuthService 2.6.0 - Open Redirect\n# Exploit Author: Piyush Patil\n# Affected Component: Pluggable Zope authentication/authorization framework\n# Component Link: https://pypi.org/project/Products.PluggableAuthService/\n# Version: < 2.6.1\n# CVE: CVE-2021-21337\n# Reference: https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrr\n--------------------------Proof of Concept-----------------------\n\n1- Goto https://localhost/login\n2- Turn on intercept and click on the login\n3- Change \"came_from\" parameter value to https://attacker.com\n4- User will be redirected to an attacker-controlled website.\n\nFix: pip install \"Products.PluggableAuthService>=2.6.1\"\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:40.381324Z"}