Plone PlonePAS Unspecified Authentication Bypass Vulnerability

Bugtraq ID:	34664
Class:	Unknown
CVE:	CVE-2009-0662
Remote:	Yes
Local:	No
Published:	Apr 21 2009 12:00AM
Updated:	Apr 24 2009 06:36PM
Credit:	Karen Chan
Vulnerable:	Plone Plone 3.0.4 Plone Plone 3.0.3 Plone Plone 3.0.2 Plone Plone 3.0.1 Plone Plone 3.2 Plone Plone 3.1 Plone Plone 3.0
Not Vulnerable:

Plone PlonePAS Unspecified Authentication Bypass Vulnerability

Plone is prone to an authentication-bypass vulnerability.

Attackers can exploit this vulnerability to gain unauthorized access to another user's account, which may aid in further attacks.

All versions of Plone 3.x running versions prior to PlonePAS 3.9, 3.9 egg, and 3.2.2 are vulnerable.

Plone PlonePAS Unspecified Authentication Bypass Vulnerability

Attackers can exploit this issue via a browser.

Plone PlonePAS Unspecified Authentication Bypass Vulnerability

Solution:
Vendor updates are available. Please see the references for details.


Plone Plone 3.0

• Plone PlonePAS 3.2.2
  http://plone.org/products/plonepas/releases/3.2.2

Plone Plone 3.1

• Plone PlonePAS 3.9
  http://plone.org/products/plonepas/releases/3.9

Plone Plone 3.0.1

• Plone PlonePAS 3.2.2
  http://plone.org/products/plonepas/releases/3.2.2

Plone Plone 3.0.2

• Plone PlonePAS 3.2.2
  http://plone.org/products/plonepas/releases/3.2.2

Plone Plone 3.0.3

• Plone PlonePAS 3.2.2
  http://plone.org/products/plonepas/releases/3.2.2

Plone Plone 3.0.4

• Plone PlonePAS 3.2.2
  http://plone.org/products/plonepas/releases/3.2.2

Plone PlonePAS Unspecified Authentication Bypass Vulnerability

References:

• Plone Homepage (Plone)
  
• CVE-2009-0662: Authentication flaw in login form (Plone)