PT-2014-2334

CVE-2012-5507

Published

2014-09-30

Updated

2018-07-23

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Zope versions prior to 2.13.19 Plone versions prior to 4.2.3 Plone version 4.3 before beta 1

Description The issue allows remote attackers to obtain passwords due to timing discrepancies in password validation. This is related to the AccessControl/AuthEncoding.py component in Zope.

Recommendations For Zope versions prior to 2.13.19, update to version 2.13.19 or later. For Plone versions prior to 4.2.3, update to version 4.2.3 or later. For Plone version 4.3 before beta 1, update to beta 1 or later.

Exploitability

Fix

Impacts

Researchers

Christian Heimes

Vendors

Affected products

Weakness enumeration

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\'Race Condition\')

Related identifiers

CVE-2012-5507

GHSA-3QPR-7RMG-73V8