Django Blog Zinnia
Monthly
Cleartext storage of blog entry protection passwords in django-blog-zinnia (all versions through 0.20) exposes those passwords to any local actor with read access to the application's storage layer. The flaw resides in the Protected Entry Password Handler at `zinnia/views/mixins/entry_protection.py`, where passwords used to gate access to individual blog entries are persisted without hashing or encryption. No public exploit code exists and no actively exploited status has been confirmed; the project maintainer has not responded to the coordinated disclosure, making a vendor-issued patch unlikely.
Cleartext storage of blog entry protection passwords in django-blog-zinnia (all versions through 0.20) exposes those passwords to any local actor with read access to the application's storage layer. The flaw resides in the Protected Entry Password Handler at `zinnia/views/mixins/entry_protection.py`, where passwords used to gate access to individual blog entries are persisted without hashing or encryption. No public exploit code exists and no actively exploited status has been confirmed; the project maintainer has not responded to the coordinated disclosure, making a vendor-issued patch unlikely.