CVE-2020-7940

Advisory

Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. See: CVE-2020-7940.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.


MISC:https://plone.org/security/hotfix/20200121: https://plone.org/security/hotfix/20200121
MISC:https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked: https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked
MISC:https://www.openwall.com/lists/oss-security/2020/01/22/1: https://www.openwall.com/lists/oss-security/2020/01/22/1
MLIST:[oss-security] 20200124 Re: Plone security hotfix 20200121: http://www.openwall.com/lists/oss-security/2020/01/24/1

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7940
• https://plone.org/security/hotfix/20200121
• https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked
• https://www.openwall.com/lists/oss-security/2020/01/22/1
• http://www.openwall.com/lists/oss-security/2020/01/24/1