PT-2008-2977 · Plone · Plone Cms

Adrian Pastor + 2 · Published 2008-03-20 · Updated 2022-05-01 · CVE-2008-1396

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Plone CMS versions 3.x through 3.1.x

Description The issue allows remote attackers to gain permanent access to an account by sniffing the network, due to the use of invariant data when calculating an HMAC-SHA1 value for an authentication cookie. This makes it easier for attackers to exploit the system.

Recommendations For Plone CMS versions 3.x through 3.1.x, consider updating the authentication mechanism to use more secure and variable data when calculating the HMAC-SHA1 value for authentication cookies, to prevent remote attackers from gaining permanent access to accounts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2008-1396

GHSA-HJP5-HV33-Q58G

Affected Products

Plone Cms

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-1396 · Security Note
• https://osv.dev/vulnerability/GHSA-hjp5-hv33-q58g · Vendor Advisory
• https://github.com/plone/Plone · Note
• http://securityreason.com/securityalert/3754 · Note
• http://securityfocus.com/archive/1/489544/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41421 · Note
• http://procheckup.com/Hacking_Plone_CMS.pdf · Note