PT-2008-2977 · Plone · Plone Cms

Adrian Pastor + 2 · Publicado 2008-03-20 · Atualizado 2022-05-01 · CVE-2008-1396

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Plone CMS versions 3.x through 3.1.x

Description The issue allows remote attackers to gain permanent access to an account by sniffing the network, due to the use of invariant data when calculating an HMAC-SHA1 value for an authentication cookie. This makes it easier for attackers to exploit the system.

Recommendations For Plone CMS versions 3.x through 3.1.x, consider updating the authentication mechanism to use more secure and variable data when calculating the HMAC-SHA1 value for authentication cookies, to prevent remote attackers from gaining permanent access to accounts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2008-1396

GHSA-HJP5-HV33-Q58G

Produtos afetados

Plone Cms

Referências · 7

• https://github.com/plone/Plone · Nota
• http://securityreason.com/securityalert/3754 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1396 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-hjp5-hv33-q58g · Aviso do Fabricante
• http://securityfocus.com/archive/1/489544/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41421 · Nota
• http://procheckup.com/Hacking_Plone_CMS.pdf · Nota