CVE-2009-0662

MediumCVSS 6.0/10Last modified Jun 16, 2026

Description

The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.

Metrics

CVSS 2.0 6.0/10AV:N/AC:M/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/53975
http://plone.org/products/plone/security/advisories/cve-2009-0662Patch, Vendor Advisory
http://secunia.com/advisories/34840Vendor Advisory
http://www.securityfocus.com/bid/34664
https://exchange.xforce.ibmcloud.com/vulnerabilities/50061
http://osvdb.org/53975
http://plone.org/products/plone/security/advisories/cve-2009-0662Patch, Vendor Advisory
http://secunia.com/advisories/34840Vendor Advisory
http://www.securityfocus.com/bid/34664
https://exchange.xforce.ibmcloud.com/vulnerabilities/50061

Timeline

Published: Apr 23, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-06637.5Heap-based buffer overflow in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module 1.49 for Perl might allow context-dependent attackers to exe CVE-2009-06644.3Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.0.x before 1.0.11 and 1.1.x before 1.1.3 allow remote attackers to inject ar CVE-2009-06677.2Untrusted search path vulnerability in Agent/Backend.pm in Ocsinventory-Agent before 0.0.9.3, and 1.x before 1.0.1, in OCS Inventory allows CVE-2009-06686.5Unspecified vulnerability in Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enable CVE-2009-06697.5Zope Object Database (ZODB) before 3.8.2, when certain Zope Enterprise Objects (ZEO) database sharing is enabled, allows remote attackers to CVE-2009-06726.5SQL injection vulnerability in the Resend_Email module in Raven Web Services RavenNuke 2.30 allows remote authenticated administrators to ex CVE-2009-06736.5Eval injection vulnerability in the Custom Fields feature in the Your Account module in Raven Web Services RavenNuke 2.30 allows remote auth CVE-2009-06746.0images/captcha.php in Raven Web Services RavenNuke 2.30, when register_globals and display_errors are enabled, allows remote attackers to de CVE-2009-06752.1The skfp_ioctl function in drivers/net/skfp/skfddi.c in the Linux kernel before 2.6.28.6 permits SKFP_CLR_STATS requests only when the CAP_N CVE-2009-06762.1The sock_getsockopt function in net/core/sock.c in the Linux kernel before 2.6.28.6 does not initialize a certain structure member, which al CVE-2009-06776.5avatarlist.php in the Your Account module, reached through modules.php, in Raven Web Services RavenNuke 2.30 allows remote authenticated use CVE-2009-06785.0images/captcha.php in RavenNuke 2.30 allows remote attackers to obtain sensitive information via an aFonts array parameter value that does n