AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2012-5507US | medium4.3 | — | ||
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2012/11/10/1WEB
- https://bugs.launchpad.net/zope2/+bug/1071067WEB
- https://github.com/advisories/GHSA-3qpr-7rmg-73v8ADVISORY
- https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txtWEB
- https://plone.org/products/plone-hotfix/releases/20121106WEB
- https://plone.org/products/plone/security/advisories/20121106/23ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan