CVE-2009-0662

Advisory

Products-plonepas 3.9 fixes the cookie plugin's login handler to not trust the username from the request. Instead, now it's used the login name of the currently authenticated user. This fixes CVE-2009-0662.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

----------------

- Fix the cookie plugin's login handler to not trust the username
from the request. Instead we use the login name of the currently
authenticated user. This fixes CVE-2009-0662 (see
http://plone.org/products/plone/security/advisories/cve-2009-0662
for more information).
[wichert]

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0662
• http://secunia.com/advisories/34840
• http://plone.org/products/plone/security/advisories/cve-2009-0662
• http://osvdb.org/53975
• http://www.securityfocus.com/bid/34664
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50061