CVE-2008-1396: Plone CMS

Medium severity, CVSS 4.3. EPSS: 1.1% chance of exploitation in the next 30 days.

Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.

Affected products

• Plone Plone CMS: any version

Published 2008-03-20. Last modified 2026-06-16.