pypi package report

Is products-pluggableauthservice safe?

3 known vulnerabilities, worst severity HIGH.

// reach

10 direct dependencies

3 carry known advisories, worst HIGH

12 packages depend on it

an advisory here reaches each of them

Create a free accountfor every dependency path, dependent and what to upgrade
// ai model usage

No published models are known to use this package.

cvss
0.0
medium

severity out of 10

epss
0.00%
medium

chance of exploitation in 30 days, 73rd percentile of all CVEs

xyz score
not scored

CyberXYZ composite out of 10

fig. 01 — GHSA-p75f-g7gx-2r7p, the advisory selected below

// 3 advisories

GHSA-p75f-g7gx-2r7p

HIGHCVE-2021-21336
// impact

What kind of vulnerability is it? Who is impacted?

Information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin.

// patches

Has the problem been patched? What versions should users upgrade to?

The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do pip install "Products.PluggableAuthService>=2.6.0"

// workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no workaround. Users are encouraged to upgrade.

// references

Are there any links users can visit to find out more?

// for more information

If you have any questions or comments about this advisory:

// cvss v3.1 vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Checked 2026-09-26 at 04:37 UTC. The most recent advisory here was published 2021-06-18. Updated continuously from NVD, GHSA, OSV and CNA feeds.

Think a verdict here is wrong? Tell us — we respond within 2 business days.