CVE-2008-1394: High severity plone cms vulnerability
Plone CMS before 3 places a base64 encoded form of the username and password in the ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
Other sources
Plone CMS before 3 places a base64 encoded form of the username and password in the ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-1394?
CVE-2008-1394 is considered to have a medium severity because it exposes user credentials through insecure cookie handling.
How do I fix CVE-2008-1394?
To fix CVE-2008-1394, upgrade Plone CMS to version 3.0 or later as it addresses this vulnerability.
Who is affected by CVE-2008-1394?
CVE-2008-1394 affects all versions of Plone CMS prior to 3.0, including versions 2.5 and earlier.
What type of attack does CVE-2008-1394 facilitate?
CVE-2008-1394 facilitates credential theft attacks, as usernames and passwords are encoded in cookies that can be easily intercepted.
Is there a workaround for CVE-2008-1394 until I can upgrade?
There is no robust workaround for CVE-2008-1394; upgrading to a secure version is the recommended solution.