CVE Database · CVE-2008-1396
CVSS v3.1
N/A
EPSS
1.13%
Published
Mar 19, 2008
Modified
Apr 22, 2026
Public PoC / Exploit
All weaponized →No public PoC or exploit code indexed for this CVE.
Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.
Description
Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.
Weaknesses (CWE)
Affected Products (1)
References (8)
