{"id":"CVE-2008-1393","aliases":["GHSA-593c-j348-f3gv","PYSEC-2026-731"],"title":"Plone Improper Session Management","summary":"Plone Improper Session Management","severity":"high","vendor":"plone","product":"plone","ecosystem":"pip","affected":["plone < 3.0"],"patched":["plone 3.0"],"published":"2022-05-01","updated":"2026-07-06","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-593c-j348-f3gv","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1393"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41427"},{"url":"https://github.com/plone/Plone"},{"url":"http://plone.org/documentation/how-to/secure-login-without-plain-text-passwords"},{"url":"http://plone.org/products/plone/roadmap/48?"},{"url":"http://securityreason.com/securityalert/3754"},{"url":"http://www.procheckup.com/Hacking_Plone_CMS.pdf"},{"url":"http://www.securityfocus.com/archive/1/489544/100/0/threaded"}],"tags":["osv","pip"],"epss":0.02904,"epssPercentile":0.86301,"ingestedAt":"2026-07-08T18:25:45.827Z","slug":"CVE-2008-1393","body":"## Overview\n\nPlone CMS before 3, places a base64 encoded form of the username and password in the `__ac` cookie for the admin account, which makes it easier for remote attackers to obtain administrative privileges by sniffing the network.\n\n## Affected packages\n\n- `plone < 3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `plone 3.0`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.6,"exploitation":0,"ransomware":0},"changes":[]}