Plone - 'in_portal.py' < 4.1.3 Session Hijacking

Author: Cyrill Bannwart
type: webapps
platform: python
port: nan
date_added: 2013-07-31 
date_updated: 2015-11-17 
verified: 1 
codes: CVE-2013-4200;OSVDB-95863 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/61964/info

Plone is prone to a session-hijacking vulnerability.

An attacker can exploit this issue to hijack user sessions and gain unauthorized access to the affected application.

Note: This issue was previously discussed in the BID 61544 (Plone Multiple Remote Security Vulnerabilities), but has been moved to its own record to better document it.

https://www.example.com/acl_users/credentials_cookie_auth/require_login?next=+https%3A//www.csnc.ch