CVE-2008-1396
Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.
- EPSS
- 1.1% chance of exploitation in the next 30 days; higher than 66% of CVEs (scores of 2026-10-31)
- CWE
- CWE-255
- Published
- Modified
- Record from
- the NVD, synced
Affected
- plone:plone_cms
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hjp5-hv33-q58g | PyPI | plone | <=3.1.7 | no fix published |
| PYSEC-2026-732 | PyPI | plone | <=3.1.7 | no fix published |