affected:
- package:
    ecosystem: PyPI
    name: plone
    purl: pkg:pypi/plone
  ranges:
  - events:
    - introduced: "3.0"
    - last_affected: "3.1"
    - last_affected: "3.2"
    - last_affected: "3.3"
    - last_affected: "3.4"
    - last_affected: "3.5"
    type: ECOSYSTEM
  ecosystem_specific: {}
aliases:
- CVE-2009-0662
details: The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for
  Plone, does not properly handle the login form, which allows remote authenticated
  users to acquire the identity of an arbitrary user via unspecified vectors.
id: PYSEC-2009-17
modified: '2026-05-20T09:19:11.136657Z'
published: '2009-04-23T17:30:01.640Z'
references:
- type: WEB
  url: http://osvdb.org/53975
- type: WEB
  url: http://www.securityfocus.com/bid/34664
- type: WEB
  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/50061
- type: ADVISORY
  url: http://secunia.com/advisories/34840
- type: FIX
  url: http://plone.org/products/plone/security/advisories/cve-2009-0662