Description
Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://securityreason.com/securityalert/3754 ↗
- http://www.securityfocus.com/archive/1/489544/100/0/threaded ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41427 ↗
- http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords ↗
- http://www.procheckup.com/Hacking_Plone_CMS.pdf ↗
- http://plone.org/products/plone/roadmap/48? ↗