{"id":"CVE-2008-1394","aliases":["GHSA-mq3q-jjph-rp5p","PYSEC-2026-734"],"title":"Plone CMS Improper Session Management","summary":"Plone CMS Improper Session Management","severity":"high","vendor":"plone","product":"plone","ecosystem":"pip","affected":["plone < 3.0"],"patched":["plone 3.0"],"published":"2022-05-01","updated":"2026-07-06","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-mq3q-jjph-rp5p","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1394"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41425"},{"url":"https://github.com/plone/Plone"},{"url":"http://plone.org/about/security/overview/security-overview-of-plone"},{"url":"http://securityreason.com/securityalert/3754"},{"url":"http://www.procheckup.com/Hacking_Plone_CMS.pdf"},{"url":"http://www.securityfocus.com/archive/1/489544/100/0/threaded"}],"tags":["osv","pip"],"epss":0.01438,"epssPercentile":0.71568,"ingestedAt":"2026-07-08T18:25:51.384Z","slug":"CVE-2008-1394","body":"## Overview\n\nPlone CMS before 3 places a base64 encoded form of the username and password in the `__ac` cookie for all user accounts, which makes it easier for remote attackers to obtain access by sniffing the network.\n\n## Affected packages\n\n- `plone < 3.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `plone 3.0`","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":41.3,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}