Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the…

Description

Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.

Scores

EPSS (exploitation in 30 days)

2.9% · top 13% of all CVEs (4 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 10.0.

Weakness

• n/a
• CWE-255 (opens in a new tab)All about CWE-255 and its CVEs

Affected products

• n/a

  • affected n/a

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• PyPIPloneGHSA-593c-j348-f3gv (opens in a new tab)

References (6)

• 3754 (opens in a new tab)third-party-advisoryx_refsource_SREASONx_transferred
• 20080313 PR08-02: Plone CMS Security Research - the Art of Plowning (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
• plone-accookie-admin-mitm(41427) (opens in a new tab)vdb-entryx_refsource_XFx_transferred
• http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords (opens in a new tab)x_refsource_MISCx_transferred
• http://www.procheckup.com/Hacking_Plone_CMS.pdf (opens in a new tab)x_refsource_MISCx_transferred
• http://plone.org/products/plone/roadmap/48? (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-593c-j348-f3gv (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2008-1393](https://trackcve.app/badge/CVE-2008-1393.svg)](https://trackcve.app/cve/CVE-2008-1393)

Record last updated 7 Aug 2024, 08:17 UTC.