SUSE CVE-2010-2944

The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges...

Debian DSA-2096-1 : zope-ldapuserfolder - missing input validation

Jeremy James discovered that in LDAPUserFolder, a Zope extension used to authenticate against an LDAP server, the authentication code does not verify the password provided for the emergency user. Malicious users that manage to get the emergency user login can use this flaw to gain administrative...

[SECURITY] [DSA 2096-1] New zope-ldapuserfolder packages fix authentication bypass

------------------------------------------------------------------------ Debian Security Advisory DSA-2096-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff August 24, 2010 http://www.debian.org/security/faq -...

CVE-2010-2944

The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges...

CVE-2010-2944

CVE-2010-2944 affects zope-ldapuserfolder (LDAPUserFolder/LDAPUserFolder.py) with version 2.9-1, where the authentication code does not verify the emergency account password. This allows remote attackers to gain privileges on the Zope instance. Debian’s DSA-2096-1 fixes the issue by upgrading to ...