AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 01:44
Type | Values Removed | Values Added |
---|---|---|
References | () http://www.openwall.com/lists/oss-security/2012/11/10/1 - | |
References | () https://bugs.launchpad.net/zope2/+bug/1071067 - | |
References | () https://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt - | |
References | () https://plone.org/products/plone-hotfix/releases/20121106 - Patch | |
References | () https://plone.org/products/plone/security/advisories/20121106/23 - Vendor Advisory |
Information
Published : 2014-09-30 14:55
Updated : 2024-11-21 01:44
NVD link : CVE-2012-5507
Mitre link : CVE-2012-5507
CVE.ORG link : CVE-2012-5507
JSON object : View
Products Affected
zope
- zope
plone
- plone
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')