Design/Logic Flaw

2009-04-2317:30:00

PRIOn knowledge base

www.prio-n.com

6.8 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

72.0%

JSON

The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.

CPENameOperatorVersion
plonepaseq3.0
plonepaseq3.1
plonepaseq3.2
plonepaseq3.3
plonepaseq3.4
plonepaseq3.5

Name	Operator	Version
plonepas	eq	3.0
plonepas	eq	3.1
plonepas	eq	3.2
plonepas	eq	3.3
plonepas	eq	3.4
plonepas	eq	3.5

References

osvdb.org/53975

plone.org/products/plone/security/advisories/cve-2009-0662

secunia.com/advisories/34840

www.securityfocus.com/bid/34664

exchange.xforce.ibmcloud.com/vulnerabilities/50061