CVE-2009-0662
Moderate severity vulnerability that affects Products.PlonePAS
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
Exploit likelihood
What each source reports
NVD Score used
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
- Record
CVE-2009-0662- CVSS 2.0
- 6.0 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
- Record
CVE-2009-0662- Updated
- 2026-11-02
EUVDEUVD-2018-0304 No score
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
- Record
EUVD-2018-0304- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pq3x-96c3-xgjg No score
Moderate severity vulnerability that affects Products.PlonePAS
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
- Record
GHSA-pq3x-96c3-xgjg- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVGHSA-pq3x-96c3-xgjg No score
Moderate severity vulnerability that affects Products.PlonePAS
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
- Record
GHSA-pq3x-96c3-xgjg- Weakness
- CWE-287
- Updated
- 2026-11-02
OSVPYSEC-2009-17 No score
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
- Record
PYSEC-2009-17- Updated
- 2026-11-02
OSVPYSEC-2026-739 No score
Moderate severity vulnerability that affects Products.PlonePAS
The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.
- Record
PYSEC-2026-739- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
products-plonepasPyPI |
3 up to 3.9 | 3.9 |
products-plonepasPyPI |
3 up to 3.9, plus listed versions 3.03.13.23.2.13.3 Show 5 moreShow less3.43.53.63.73.8 |
3.9 |
plonePyPI |
3.0 to 3.1, 3.0 to 3.2, 3.0 to 3.3, 3.0 to 3.4, 3.0 to 3.5 | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-0662 is a medium vulnerability (CVSS 6.0) in Plone Plonepas, published April 23, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in products-plonepas 3.9.
References
securityfocus.com/bid/34664
exchange.xforce.ibmcloud.com/vulnerabilities/50061
secunia.com/advisories/34840
plone.org/products/plone/security/advisories/cve-2009-0662
osvdb.org/53975
nvd.nist.gov/vuln/detail/CVE-2009-0662
github.com/advisories/GHSA-pq3x-96c3-xgjg
pypi.org/project/products-plonepas