CVE-2009-0662

2009-04-2317:30:01

CWE-287

mitre

web.nvd.nist.gov

plonepas

plone

remote authentication

identity theft

cve-2009-0662

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

6.5

Confidence

Low

EPSS

0.004

Percentile

72.0%

JSON

The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.

Affected configurations

Nvd

Node

ploneplonepasMatch3.0

ploneplonepasMatch3.1

ploneplonepasMatch3.2

ploneplonepasMatch3.3

ploneplonepasMatch3.4

ploneplonepasMatch3.5

AND

ploneplone

VendorProductVersionCPE
ploneplonepas3.0cpe:2.3:a:plone:plonepas:3.0:*:*:*:*:*:*:*
ploneplonepas3.1cpe:2.3:a:plone:plonepas:3.1:*:*:*:*:*:*:*
ploneplonepas3.2cpe:2.3:a:plone:plonepas:3.2:*:*:*:*:*:*:*
ploneplonepas3.3cpe:2.3:a:plone:plonepas:3.3:*:*:*:*:*:*:*
ploneplonepas3.4cpe:2.3:a:plone:plonepas:3.4:*:*:*:*:*:*:*
ploneplonepas3.5cpe:2.3:a:plone:plonepas:3.5:*:*:*:*:*:*:*
ploneplone*cpe:2.3:a:plone:plone:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
plone	plonepas	3.0	cpe:2.3:a:plone:plonepas:3.0:::::::*
plone	plonepas	3.1	cpe:2.3:a:plone:plonepas:3.1:::::::*
plone	plonepas	3.2	cpe:2.3:a:plone:plonepas:3.2:::::::*
plone	plonepas	3.3	cpe:2.3:a:plone:plonepas:3.3:::::::*
plone	plonepas	3.4	cpe:2.3:a:plone:plonepas:3.4:::::::*
plone	plonepas	3.5	cpe:2.3:a:plone:plonepas:3.5:::::::*
plone	plone	*	cpe:2.3:a:plone:plone::::::::