CVE-2008-1394
Plone CMS Improper Session Management
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
Exploit likelihood
What each source reports
NVD Score used
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
- Record
CVE-2008-1394- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
- Record
CVE-2008-1394- Updated
- 2026-11-02
EUVDEUVD-2022-4607 No score
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
- Record
EUVD-2022-4607- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mq3q-jjph-rp5p No score
Plone CMS Improper Session Management
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
- Record
GHSA-mq3q-jjph-rp5p- Updated
- 2026-11-02
OSVGHSA-mq3q-jjph-rp5p No score
Plone CMS Improper Session Management
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
- Record
GHSA-mq3q-jjph-rp5p- Updated
- 2026-11-02
OSVPYSEC-2026-734 No score
Plone CMS Improper Session Management
Plone CMS before 3 places a base64 encoded form of the username and password in the __ac cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.
- Record
PYSEC-2026-734- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
plonePyPI |
before 3.0 | 3.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-1394 is a high vulnerability (CVSS 7.5) in Plone Cms, published March 20, 2008. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in plone 3.0.
References
securityreason.com/securityalert/3754
securityfocus.com/archive/1/489544/100/0/threaded
plone.org/about/security/overview/security-overview-of-plone
procheckup.com/Hacking_Plone_CMS.pdf
exchange.xforce.ibmcloud.com/vulnerabilities/41425
nvd.nist.gov/vuln/detail/CVE-2008-1394
github.com/advisories/GHSA-mq3q-jjph-rp5p
pypi.org/project/plone