{"id":"CVE-2008-1396","aliases":["GHSA-hjp5-hv33-q58g","PYSEC-2026-732"],"title":"Plone credentials stored in session cookie","summary":"Plone credentials stored in session cookie","severity":"medium","vendor":"plone","product":"plone","ecosystem":"pip","affected":["plone <= 3.1.7"],"published":"2022-05-01","updated":"2026-07-06","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-hjp5-hv33-q58g","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-1396"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41421"},{"url":"https://github.com/plone/Plone"},{"url":"http://securityreason.com/securityalert/3754"},{"url":"http://www.procheckup.com/Hacking_Plone_CMS.pdf"},{"url":"http://www.securityfocus.com/archive/1/489544/100/0/threaded"}],"tags":["osv","pip"],"epss":0.01139,"epssPercentile":0.64724,"ingestedAt":"2026-07-08T18:25:50.264Z","slug":"CVE-2008-1396","body":"## Overview\n\nPlone CMS 3.1.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.\n\n## Affected packages\n\n- `plone <= 3.1.7`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.2,"exploitation":0,"ransomware":0},"changes":[]}