Plone and Zope2 affected by Race Condition
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2012-5507US | medium4.3 | — | ||
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2012/11/10/1WEB
- https://bugs.launchpad.net/zope2/+bug/1071067WEB
- https://github.com/advisories/GHSA-3qpr-7rmg-73v8ADVISORY
- https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txtWEB
- https://github.com/pypa/advisory-database/tree/main/vulns/plone/PYSEC-2014-49.yamlWEB
- https://github.com/pypa/advisory-database/tree/main/vulns/zope2/PYSEC-2014-75.yamlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2012-5507ADVISORY
- https://plone.org/products/plone-hotfix/releases/20121106WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan