Lucene search
HistoryMar 20, 2008 - 12:44 a.m.
CVE-2008-1393
plone cms
cve-2008-1393
security vulnerability
admin credentials
network sniffing
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
6.8 Medium
AI Score
Confidence
Low
0.019 Low
EPSS
Percentile
88.7%
Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
Affected configurations
Node
ploneplone_cmsRange≤3
ORploneplone_cmsRange≤3.0.5
| CPE | Name | Operator | Version |
|---|---|---|---|
| plone:plone_cms | plone plone cms | le | 3 |
| plone:plone_cms | plone plone cms | le | 3.0.5 |
Related
nvd
nvd
CVE-2008-1393
2008-03-20 00:44:00
prion
prion
Default credentials
2008-03-20 00:44:00
github
github
Plone Improper Session Management
2022-05-01 23:39:38
ubuntucve
ubuntucve
CVE-2008-1393
2008-03-20 00:00:00
cvelist
cvelist
CVE-2008-1393
2008-03-20 00:00:00
10 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
6.8 Medium
AI Score
Confidence
Low
0.019 Low
EPSS
Percentile
88.7%
Related for CVE-2008-1393