CVE-2008-1393
Plone CMS < 3.0 - Unauthenticated Credential Exposure via __ac Cookie
Title source: llmDescription
Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
References (6)
Core 6
Core References
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/3754
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/489544/100/0/threaded
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/41427
Exploit x_refsource_misc
http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords
Various Sources x_refsource_misc
http://www.procheckup.com/Hacking_Plone_CMS.pdf
Exploit x_refsource_misc
http://plone.org/products/plone/roadmap/48?
Scores
EPSS
0.0288
EPSS Percentile
85.4%
Details
CWE
CWE-255
Status
published
Products (2)
plone/plone_cms
< 3
pypi/Plone
0 - 3.0PyPI
Published
Mar 20, 2008
Tracked Since
Feb 18, 2026