PT-2009-3303 · Plone · Plonepas

Published 2009-04-23 · Updated 2018-07-23 · CVE-2009-0662

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions PlonePAS product versions 3.x before 3.9 PlonePAS product versions 3.2.x before 3.2.2

Description The issue concerns improper handling of the login form, allowing remote authenticated users to acquire the identity of an arbitrary user.

Recommendations For PlonePAS product versions 3.x before 3.9, update to version 3.9 or later. For PlonePAS product versions 3.2.x before 3.2.2, update to version 3.2.2 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-0662

GHSA-PQ3X-96C3-XGJG

PYSEC-2009-17

Affected Products

Plonepas

References · 10

• https://osv.dev/vulnerability/GHSA-pq3x-96c3-xgjg · Vendor Advisory
• http://plone.org/products/plone/security/advisories/cve-2009-0662 · Vendor Advisory
• http://secunia.com/advisories/34840 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2009-17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0662 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2009-17.yaml · Note
• https://github.com/advisories/GHSA-pq3x-96c3-xgjg · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50061 · Note
• http://securityfocus.com/bid/34664 · Note
• http://osvdb.org/53975 · Note