Is CVE-2009-0662 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2009-0662 being exploited in the wild.

How severe is CVE-2009-0662?

Medium severity, with a CVSS score of 6, published 23 July 2018.

Which products and versions are affected?

PlonePAS 3.x before 3.9, 3.2.x before 3.2.2; plone (PyPI) ECOSYSTEM:introduced=3.0,last_affected=3.1,last_affected=3.2,last_affected=3.3,last_affected=3.4,last_affected=3.5; Products.PlonePAS (PyPI) >= 3, < 3.9, ECOSYSTEM:introduced=3,fixed=3.9.

Is there a fix for CVE-2009-0662?

Yes. Products.PlonePAS (PyPI): upgrade to 3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2009-0662 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2009-0662?

Check whether you run PlonePAS, plone (PyPI) or Products.PlonePAS (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2009-0662: Plone Products.PlonePAS improper authentication in login form

Q: Is there a fix for CVE-2009-0662?

Yes. Products.PlonePAS (PyPI): upgrade to 3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2009-0662 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2009-0662?

Check whether you run PlonePAS, plone (PyPI) or Products.PlonePAS (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2009-0662 · Severity: medium · CVSS 6 · Published 2018-07-23

PlonePAS, a component used by the Plone content management system to handle user authentication and permissions, contains a flaw in its login form processing. This vulnerability allows a user who is already logged into the system to impersonate any other user. An attacker could use this to gain unauthorized access to sensitive data or administrative functions by assuming the identity of a high-privileged account.

Technologies: plone (PyPI). Vendors: Plone, PyPI.

Quick answers

Is CVE-2009-0662 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2009-0662 being exploited in the wild.
How severe is CVE-2009-0662?: Medium severity, with a CVSS score of 6, published 23 July 2018.
Which products and versions are affected?: PlonePAS 3.x before 3.9, 3.2.x before 3.2.2; plone (PyPI) ECOSYSTEM:introduced=3.0,last_affected=3.1,last_affected=3.2,last_affected=3.3,last_affected=3.4,last_affected=3.5; Products.PlonePAS (PyPI) >= 3, < 3.9, ECOSYSTEM:introduced=3,fixed=3.9.
Is there a fix for CVE-2009-0662?: Yes. Products.PlonePAS (PyPI): upgrade to 3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2009-0662 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2009-0662?: Check whether you run PlonePAS, plone (PyPI) or Products.PlonePAS (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Products.PlonePAS (PyPI): upgrade to 3.9 or later
```
pip install "Products.PlonePAS>=3.9"
```

Technical details

A vulnerability in Products.PlonePAS (versions 3.x before 3.9 and 3.2.x before 3.2.2) stems from improper handling of the login form. The flaw is categorized as CWE-287 (Improper Authentication). A remote authenticated attacker can exploit this by using unspecified vectors to acquire the identity of an arbitrary user. This effectively allows for privilege escalation or account takeover within the Plone environment. The issue is resolved in version 3.9.

Affected products

Plone Products.PlonePAS 3.x before 3.9, 3.2.x before 3.2.2

Identifiers

CVE-2009-0662
GHSA-pq3x-96c3-xgjg
PYSEC-2009-17
PYSEC-2026-739

Timeline

2009-04-23: disclosed
2009-04-23: advisory: NVD published date
2018-07-23: other: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.