CVE-2012-5507
Zope < 2.13.19 and Plone < 4.2.3 - Remote Password Exposure via Timing Attack
Title source: llmDescription
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
References (5)
Core 5
Core References
Various Sources x_refsource_confirm
https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt
Issue Tracking x_refsource_confirm
https://bugs.launchpad.net/zope2/+bug/1071067
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/11/10/1
Patch x_refsource_confirm
https://plone.org/products/plone-hotfix/releases/20121106
Vendor Advisory x_refsource_confirm
https://plone.org/products/plone/security/advisories/20121106/23
Scores
EPSS
0.0093
EPSS Percentile
56.0%
Details
CWE
CWE-362
Status
published
Products (50)
plone/plone
1.0
plone/plone
1.0.1
plone/plone
1.0.2
plone/plone
1.0.3
plone/plone
1.0.4
plone/plone
1.0.5
plone/plone
1.0.6
plone/plone
2.0
plone/plone
2.0.1
plone/plone
2.0.2
... and 40 more
Published
Sep 30, 2014
Tracked Since
Feb 18, 2026