{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"3.0","last_affected":"3.1"}],"component":"plone","cve_ids":["CVE-2009-0662"],"ecosystem":"PyPI","epss":0.0097,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-pq3x-96c3-xgjg","id":"tcs_01M5KG57A4MA32K6PE3VVEMSFK","modified_at":"2026-07-06T08:11:19.583234404Z","published_at":"2009-04-23T17:30:01.640Z","references":["https://osv.dev/vulnerability/PYSEC-2009-17","http://osvdb.org/53975","http://www.securityfocus.com/bid/34664","https://exchange.xforce.ibmcloud.com/vulnerabilities/50061","http://secunia.com/advisories/34840","http://plone.org/products/plone/security/advisories/cve-2009-0662"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2009-17","url":"https://osv.dev/vulnerability/PYSEC-2009-17"}],"summary":"The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrar"}