Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2021-32633 Details

Description

Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:8.8 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CNA: [email protected]CVSS-B:6.8 MEDIUMVector:CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://cyllective.com/blog/post/plone-authenticated-rce-cve-2021-32633/	CVE	ExploitThird Party Advisory
https://github.com/zopefoundation/Zope/commit/1f8456bf1f908ea46012537d52bd7e752a532c91	CVE	PatchThird Party Advisory
https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36	CVE	Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/21/1	CVE	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/22/1	CVE	Mailing ListThird Party Advisory
https://cyllective.com/blog/post/plone-authenticated-rce-cve-2021-32633/	[email protected]	ExploitThird Party Advisory
https://github.com/zopefoundation/Zope/commit/1f8456bf1f908ea46012537d52bd7e752a532c91	[email protected]	PatchThird Party Advisory
https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36	[email protected]	Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/21/1	[email protected]	Mailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2021/05/22/1	[email protected]	Mailing ListThird Party Advisory

see all 10 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]

Affected Products

Product	Versions
plone plone	<= 4.3.20 >= 5.0, <= 5.2.4
CPE cpe:2.3:a:plone:plone:::::::: Remediation No remediation found in references.
zope zope	< 4.6 >= 5.0, < 5.2
CPE cpe:2.3:a:zope:zope:::::::: Remediation No remediation found in references.

Change History

8 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Apr 6, 2022	Modified Analysis	[email protected]
Jul 30, 2021	CVE Modified	[email protected]
May 27, 2021	Initial Analysis	[email protected]
May 22, 2021	CVE Modified	[email protected]
May 21, 2021	CVE Modified	[email protected]