CVE-2020-7940

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-521

Affected software

No affected versions have been published.

Timeline

Published
Jan 23, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-79419.8A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without neediCVE-2020-79426.5Previously, Puppet operated on a model that a node with a valid certificate was entitled to all information in the system and that a compromCVE-2020-79437.5Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contaCVE-2020-79447.7In Continuous Delivery for Puppet Enterprise (CD4PE) before 3.4.0, changes to resources or classes containing Sensitive parameters can resulCVE-2020-79455.5Local registry credentials were included directly in the CD4PE deployment definition, which could expose these credentials to users who shouCVE-2020-79479.8An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulledCVE-2020-79488.8An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. A user can perform an insecure direct object reference.CVE-2020-79497.8schemasystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming seCVE-2020-79507.8meshsystem.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gaming servCVE-2020-79517.8meshsystem.dll in Valve Dota 2 before 7.23e allows remote attackers to achieve code execution or denial of service by creating a gaming servCVE-2020-79527.8rendersystemdx9.dll in Valve Dota 2 before 7.23f allows remote attackers to achieve code execution or denial of service by creating a gamingCVE-2020-79537.5An issue was discovered in OpServices OpMon 9.3.2. Without authentication, it is possible to read server files (e.g., /etc/passwd) due to th
CVE-2020-7940: High severity, CVSS 7.5 | Vulnix