Plone and Zope2 affected by Race Condition
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2012-5507US | medium4.3 | — | ||
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2012/11/10/1WEB
- https://bugs.launchpad.net/zope2/+bug/1071067WEB
- https://github.com/advisories/GHSA-3qpr-7rmg-73v8ADVISORY
- https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txtWEB
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-49.yamlWEB
- https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-75.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2012-5507ADVISORY
- https://plone.org/products/plone-hotfix/releases/20121106WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan