CVE-2008-1396

EUVD-2022-4170
Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
Affected Products (NVD)
VendorProductVersion
ploneplone_cms
*
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
zope-cmfplone
dapper
ignored
edgy
ignored
feisty
ignored
gutsy
ignored
hardy
ignored
intrepid
ignored
jaunty
dne
karmic
dne
lucid
dne
maverick
dne
natty
dne
oneiric
dne
Common Weakness Enumeration
References
http://securityreason.com/securityalert/3754
http://www.procheckup.com/Hacking_Plone_CMS.pdf
http://www.securityfocus.com/archive/1/489544/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/41421
http://securityreason.com/securityalert/3754
http://www.procheckup.com/Hacking_Plone_CMS.pdf
http://www.securityfocus.com/archive/1/489544/100/0/threaded
https://exchange.xforce.ibmcloud.com/vulnerabilities/41421