Description
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | plone | >= 3.0, <= 3.1 · <= 3.2 · <= 3.3 · <= 3.4 · <= 3.5 | — | PYSEC-2009-17 |
| PyPI | products-plonepas | >= 3, < 3.9 | 3.9 | GHSA-pq3x-96c3-xgjg |
References
- 34664 vdb-entry
- plone-unspecified-session-hijacking(50061) vdb-entry
- 34840 third-party-advisory
- http://plone.org/products/plone/security/advisories/cve-2009-0662
- 53975 vdb-entry