CVE-2008-1394
Plone CMS < 3.0 - Unauthenticated Credential Exposure via __ac Cookie
Title source: llmDescription
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
References (5)
Core 5
Core References
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/3754
Third Party Advisory, VDB Entry mailing-list
x_refsource_bugtraq
http://www.securityfocus.com/archive/1/489544/100/0/threaded
Various Sources x_refsource_confirm
http://plone.org/about/security/overview/security-overview-of-plone/
Various Sources x_refsource_misc
http://www.procheckup.com/Hacking_Plone_CMS.pdf
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/41425
Scores
EPSS
0.0142
EPSS Percentile
70.1%
Details
CWE
CWE-255
Status
published
Products (6)
plone/plone_cms
2.0.5
plone/plone_cms
2.1.2
plone/plone_cms
2.1.3 rc1
plone/plone_cms
2.5 (3 CPE variants)
plone/plone_cms
< 2.5.1
pypi/Plone
0 - 3.0PyPI
Published
Mar 20, 2008
Tracked Since
Feb 18, 2026