Plone 'in_portal.py' <= 4.1.3 Session Hijacking Vulnerability

2013-07-31T00:00:00
ID EDB-ID:38738
Type exploitdb
Reporter Cyrill Bannwart
Modified 2013-07-31T00:00:00

Description

Plone 'in_portal.py' 4.1.3 Session Hijacking Vulnerability. CVE-2013-4200. Webapps exploit for python platform

                                        
                                            source: http://www.securityfocus.com/bid/61964/info

Plone is prone to a session-hijacking vulnerability.

An attacker can exploit this issue to hijack user sessions and gain unauthorized access to the affected application.

Note: This issue was previously discussed in the BID 61544 (Plone Multiple Remote Security Vulnerabilities), but has been moved to its own record to better document it. 

https://www.example.com/acl_users/credentials_cookie_auth/require_login?next=+https%3A//www.csnc.ch