PT-2008-2974 · Plone · Plone Cms

Adrian Pastor + 2 · Publicado 2008-03-20 · Atualizado 2022-05-01 · CVE-2008-1393

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Plone CMS versions prior to 3.0.6 Plone CMS versions 3.0.5 and earlier

Description The issue allows remote attackers to obtain administrative privileges by sniffing the network, as a base64 encoded form of the username and password is placed in the " ac" cookie for the admin account.

Recommendations For Plone CMS versions prior to 3.0.6, update to version 3.0.6 or later to resolve the issue. For Plone CMS versions 3.0.5 and earlier, update to version 3.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin account until a patch is available. Avoid using the ac cookie in the affected Plone CMS versions until the issue is resolved.

Exploit

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2008-1393

GHSA-593C-J348-F3GV

Produtos afetados

Plone Cms

Referências · 9

• 🔥 http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords · Exploit
• 🔥 http://plone.org/products/plone/roadmap/48? · Exploit
• https://github.com/plone/Plone · Nota
• http://securityreason.com/securityalert/3754 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41427 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1393 · Nota de Segurança
• http://securityfocus.com/archive/1/489544/100/0/threaded · Nota
• http://procheckup.com/Hacking_Plone_CMS.pdf · Nota
• https://osv.dev/vulnerability/GHSA-593c-j348-f3gv · Aviso do Fabricante