Description
Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session.
References
- 3754 third-party-advisory
- 20080313 PR08-02: Plone CMS Security Research - the Art of Plowning mailing-list
- plone-authenticationstate-weak-security(41423) vdb-entry
- http://www.procheckup.com/Hacking_Plone_CMS.pdf