CVE-2008-1395

Plone CMS - Info Disclosure

Title source: llm

Description

Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session.

References (4)

[Various Sources] http://www.procheckup.com/Hacking_Plone_CMS.pdf

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/41423

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/489544/100/0/threaded

[Third Party Advisory] http://securityreason.com/securityalert/3754

Scores

EPSS 0.0030

EPSS Percentile 53.0%

Classification

CWE

CWE-287

Status draft

Affected Products (1)

plone/plone_cms

Timeline

Published Mar 20, 2008

Tracked Since Feb 18, 2026