PT-2008-2974 · Plone · Plone Cms

Adrian Pastor + 2 · Published 2008-03-20 · Updated 2022-05-01 · CVE-2008-1393

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Plone CMS versions prior to 3.0.6 Plone CMS versions 3.0.5 and earlier

Description The issue allows remote attackers to obtain administrative privileges by sniffing the network, as a base64 encoded form of the username and password is placed in the " ac" cookie for the admin account.

Recommendations For Plone CMS versions prior to 3.0.6, update to version 3.0.6 or later to resolve the issue. For Plone CMS versions 3.0.5 and earlier, update to version 3.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin account until a patch is available. Avoid using the ac cookie in the affected Plone CMS versions until the issue is resolved.

Exploit

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-1393

GHSA-593C-J348-F3GV

Affected Products

Plone Cms

References · 9

• 🔥 http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords · Exploit
• 🔥 http://plone.org/products/plone/roadmap/48? · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-1393 · Security Note
• https://osv.dev/vulnerability/GHSA-593c-j348-f3gv · Vendor Advisory
• https://github.com/plone/Plone · Note
• http://securityreason.com/securityalert/3754 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41427 · Note
• http://securityfocus.com/archive/1/489544/100/0/threaded · Note
• http://procheckup.com/Hacking_Plone_CMS.pdf · Note