CVE-2008-1395 Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session...
HighCVSS 7.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Plone CMS does not record users' authentication states, and implements the logout feature solely on the client side, which makes it easier for context-dependent attackers to reuse a logged-out session.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| plone cms | All versions | No fix listed |
References
- 3754 third-party-advisory
- www.procheckup.com
- 20080313 PR08-02: Plone CMS Security Research - the Art of Plowning mailing-list
- plone-authenticationstate-weak-security(41423) vdb-entry