PT-2020-19862 · Plone · Plone

Damiano Esposito · Published 2020-01-23 · Updated 2022-05-24 · CVE-2020-7940

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Plone versions 4.3 through 5.2.0

Description The issue is related to missing password strength checks on some forms, allowing users to set weak passwords. This makes it easier for attackers to crack the passwords.

Recommendations For Plone versions 4.3 through 5.2.0, consider implementing custom password strength checks to enforce strong passwords until a patch is available. As a temporary workaround, restrict access to password change functionality to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2020-7940

GHSA-CW58-GPGW-HWX2

PYSEC-2020-89

Affected Products

Plone

References · 10

• https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7940 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-89 · Vendor Advisory
• https://plone.org/security/hotfix/20200121 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cw58-gpgw-hwx2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7940 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2020-89.yaml · Note
• https://github.com/plone/Plone · Note
• http://openwall.com/lists/oss-security/2020/01/24/1 · Note
• https://openwall.com/lists/oss-security/2020/01/22/1 · Note