CVE-2008-1394

Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
VendorProductVersion
ploneplone_cms
𝑥
≤ 2.5.1
ploneplone_cms
2.0.5
ploneplone_cms
2.1.2
ploneplone_cms
2.1.3:rc1
ploneplone_cms
2.5
ploneplone_cms
2.5:beta1
ploneplone_cms
2.5:beta2
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
zope-cmfplone
oneiric
dne
natty
dne
maverick
dne
lucid
dne
karmic
dne
jaunty
dne
intrepid
ignored
hardy
ignored
gutsy
ignored
feisty
ignored
edgy
ignored
dapper
ignored
Common Weakness Enumeration
References
http://plone.org/about/security/overview/security-overview-of-plone/
http://securityreason.com/securityalert/3754
http://www.procheckup.com/Hacking_Plone_CMS.pdf
http://www.securityfocus.com/archive/1/489544/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/41425
http://plone.org/about/security/overview/security-overview-of-plone/
http://securityreason.com/securityalert/3754
http://www.procheckup.com/Hacking_Plone_CMS.pdf
http://www.securityfocus.com/archive/1/489544/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/41425