| Package | Affected versions | Patched versions |
|---|---|---|
| plone | ≥ 3.2.2, < 4.2.3≥ 4.3a0, < 4.3b1≥ 4.3a1, < 4.3b1< 4.2.3 | 4.2.34.3b1 |
| zope2 | < 2.13.19 | 2.13.19 |
| plone | = 1.0= 1.0.1= 1.0.2= 1.0.3= 1.0.4= 1.0.5= 1.0.6= 2.0= 2.0.1= 2.0.2= 2.0.3= 2.0.4= 2.0.5= 2.1= 2.1.1= 2.1.2= 2.1.3= 2.1.4= 2.5= 2.5.1= 2.5.2= 2.5.3= 2.5.4= 2.5.5= 3.0= 3.0.1= 3.0.2= 3.0.3= 3.0.4= 3.0.5= 3.0.6= 3.1= 3.1.1= 3.1.2= 3.1.3= 3.1.4= 3.1.5.1= 3.1.6= 3.1.7= 3.2= 3.2.1= 3.2.2= 3.2.3= 3.3= 3.3.1= 3.3.2= 3.3.3= 3.3.4= 3.3.5= 4.0= 4.0.1= 4.0.2= 4.0.3= 4.0.4= 4.0.5= 4.0.6.1= 4.1= 4.1.4= 4.1.5= 4.1.6= 4.2= 4.2.0.1= 4.2.1= 4.2.1.1= 4.3≤ 4.2.2 | |
| zope | = 2.10.3= 2.10.8= 2.11.0= 2.11.1= 2.11.2= 2.11.3= 2.13.18= 2.5.1= 2.6.1= 2.6.4= 2.7.0= 2.7.3= 2.7.4= 2.7.5= 2.7.6= 2.7.7= 2.7.8= 2.8.1= 2.8.4= 2.8.6= 2.8.8= 2.9.2= 2.9.3= 2.9.4= 2.9.5= 2.9.6= 2.9.7 |
AccessControl/AuthEncoding.py in Zope before 2.13.19, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote attackers to obtain passwords via vectors involving timing discrepancies in password validation.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free