PT-2014-2334

CVE-2012-5507

Publicado

2014-09-30

Atualizado

2018-07-23

Descrição por

CVSS 4.0

8.7

Alta

MétricasAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.2.3 Plone version 4.3 before beta 1

Description The issue allows remote attackers to obtain passwords due to timing discrepancies in password validation. This is related to the AccessControl/AuthEncoding.py component in Zope.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone version 4.3 before beta 1, update to beta 1 or later.

Explorabilidade

Correção

Impactos

Pesquisadores

Christian Heimes

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\'Race Condition\')

Identificadores relacionados

CVE-2012-5507

GHSA-3QPR-7RMG-73V8