Plone CMS 3.x uses invariant data (a client username and a server secret) when calculating an HMAC-SHA1 value for an authentication cookie, which makes it easier for remote attackers to gain permanent access to an account by sniffing the network.
Exploitability
AV:NAC:MAu:NImpact
C:PI:NA:N4.3/AV:N/AC:M/Au:N/C:P/I:N/A:N