CVE-2020-7940: Plone allows weak passwords
Summary
CVE-2020-7940: Plone allows weak passwords. Affects plone across 3 version ranges.
>= 4.3, < 4.3.20
>= 5.0rc1, < 5.1.7
>= 5.2.0, < 5.2.2
Fixed in 4.3.20, 5.1.7 or 5.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Plone is an open-source content management system (CMS) built on top of the Zope application server. It provides a user-friendly interface for managing websites and web applications. Plone is widely used for its robustness, extensibility, and security features. However, versions 4.3 through 5.2.0 of Plone are susceptible to a vulnerability that allows users to set weak passwords without any strength checks. This can lead to easier password cracking and unauthorized access to the system.
Vulnerability Detail
The vulnerability in Plone arises from the absence of password strength checks on certain forms. This means that users can choose weak passwords that are easily guessable or crackable. As a result, attackers can exploit this weakness to gain unauthorized access to user accounts, potentially compromising sensitive information or performing malicious actions on the system. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 6.2.2 as of 23 Oct 2026
pip install --upgrade "plone==6.2.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.3, < 4.3.204.3.20pip install --upgrade "plone==4.3.20" -
>= 5.0rc1, < 5.1.75.1.7pip install --upgrade "plone==5.1.7" -
>= 5.2.0, < 5.2.25.2.2pip install --upgrade "plone==5.2.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can enhance their password security by following best practices such as using a combination of uppercase and lowercase letters, numbers, and special characters, avoiding common dictionary words, and ensuring a minimum length for passwords.
Conclusion
Plone versions 4.3 through 5.2.0 are vulnerable to weak passwords due to the absence of password strength checks. Upgrading to the fixed versions (4.3.20, 5.1.7, or 5.2.2) is crucial to mitigate the risk of unauthorized access. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for plone →
FAQ
Plone is an open-source content management system (CMS) built on top of the Zope application server. It provides a user-friendly interface for managing websites and web applications.
Versions 4.3 through 5.2.0 of Plone are affected by this vulnerability.
The vulnerability allows users to set weak passwords, making it easier for attackers to crack them and gain unauthorized access to user accounts.
To fix this vulnerability, upgrade to the fixed versions of Plone: 4.3.20, 5.1.7, or 5.2.2.
While there is no specific workaround mentioned, users can enhance password security by following best practices such as using strong and unique passwords.
Related vulnerabilities
Recent vulnerabilities recorded for plone.
