Vulnerabilities > CVE-2008-1393 - Credentials Management vulnerability in Plone CMS

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
plone
CWE-255
critical
NVD
Published: 2008-03-20
Updated: 2018-10-11

Summary

Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.

Vulnerable Configurations

Part Description Count
Application
Plone
1

Common Weakness Enumeration (CWE)

References