Plone 3.3.1 __ac cookie and security
eras mus <[email protected]> Thu, 28 May 2015 17:56:36 +0530
| Newsgroups | gmane.comp.web.zope.plone.user |
|---|---|
| Message-ID | <CALeO_hMB9C05gNh6fAdkNv+s9BKZPz-4-_HKTiGnnRuX3D+4rA@mail.gmail.com> |
Hi, In an old Plone 3.3.1 during security audit the following was done. After logging in from login form ,the cookie __ac was captured . Then logged out. The logged out message got displayed on the page. Now after injecting the same cookie value in the browser , When site is accessed it is showing as logged in. It is a security threat isn't ? Someone can capture the __ac value and log in. How to overcome this ?(without upgrading to new plone version) Please give your valuable suggestions. ------------------------------------------------------------------------------