CVE-2008-1393

Name of the Vulnerable Software and Affected Versions Plone CMS versions prior to 3.0.6 Plone CMS versions 3.0.5 and earlier

Description The issue allows remote attackers to obtain administrative privileges by sniffing the network, as a base64 encoded form of the username and password is placed in the " ac" cookie for the admin account.

Recommendations For Plone CMS versions prior to 3.0.6, update to version 3.0.6 or later to resolve the issue. For Plone CMS versions 3.0.5 and earlier, update to version 3.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the admin account until a patch is available. Avoid using the ac cookie in the affected Plone CMS versions until the issue is resolved.