CVE-2008-1393
Plone Improper Session Management
Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
Exploit likelihood
What each source reports
NVD Score used
Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
- Record
CVE-2008-1393- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
- Record
CVE-2008-1393- Updated
- 2026-11-02
EUVDEUVD-2022-2540 No score
Plone CMS 3.0.5, and probably other 3.x versions, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
- Record
EUVD-2022-2540- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-593c-j348-f3gv No score
Plone Improper Session Management
Plone CMS before 3, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
- Record
GHSA-593c-j348-f3gv- Updated
- 2026-11-02
OSVGHSA-593c-j348-f3gv No score
Plone Improper Session Management
Plone CMS before 3, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
- Record
GHSA-593c-j348-f3gv- Updated
- 2026-11-02
OSVPYSEC-2026-731 No score
Plone Improper Session Management
Plone CMS before 3, places a base64 encoded form of the username and password in the __ac cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.
- Record
PYSEC-2026-731- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plonePyPI |
before 3.0 | 3.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1393 is a high vulnerability (CVSS 10.0) in Plone Cms, published March 20, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.90%, the 87th percentile. Fixed in plone 3.0.