CVE-2008-1394

State: Published
Severity: Not scored
Published: Mar 20, 2008
Updated: Aug 7, 2024
Reserved: Mar 19, 2008

Description

Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

3754third-party-advisory
20080313 PR08-02: Plone CMS Security Research - the Art of Plowningmailing-list
http://plone.org/about/security/overview/security-overview-of-plone/
http://www.procheckup.com/Hacking_Plone_CMS.pdf
plone-accookie-mitm(41425)vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.