PT-2009-3303 · Plone · Plonepas

Publicado 2009-04-23 · Atualizado 2018-07-23 · CVE-2009-0662

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PlonePAS product versions 3.x before 3.9 PlonePAS product versions 3.2.x before 3.2.2

Description The issue concerns improper handling of the login form, allowing remote authenticated users to acquire the identity of an arbitrary user.

Recommendations For PlonePAS product versions 3.x before 3.9, update to version 3.9 or later. For PlonePAS product versions 3.2.x before 3.2.2, update to version 3.2.2 or later.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-0662

GHSA-PQ3X-96C3-XGJG

PYSEC-2009-17

Produtos afetados

Plonepas

Referências · 10

• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2009-17.yaml · Nota
• https://github.com/advisories/GHSA-pq3x-96c3-xgjg · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50061 · Nota
• http://securityfocus.com/bid/34664 · Nota
• https://osv.dev/vulnerability/GHSA-pq3x-96c3-xgjg · Aviso do Fabricante
• http://plone.org/products/plone/security/advisories/cve-2009-0662 · Aviso do Fabricante
• http://secunia.com/advisories/34840 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2009-17 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2009-0662 · Nota de Segurança
• http://osvdb.org/53975 · Nota