7.5

CVE-2014-2685

The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zend ≫ Zend Framework Version <= 1.12.3
Zend ≫ Zend Framework Version 1.0.0
Zend ≫ Zend Framework Version 1.0.0 Update rc1
Zend ≫ Zend Framework Version 1.0.0 Update rc2
Zend ≫ Zend Framework Version 1.0.0 Update rc2a
Zend ≫ Zend Framework Version 1.0.0 Update rc3
Zend ≫ Zend Framework Version 1.0.1
Zend ≫ Zend Framework Version 1.0.2
Zend ≫ Zend Framework Version 1.0.3
Zend ≫ Zend Framework Version 1.0.4
Zend ≫ Zend Framework Version 1.5.0
Zend ≫ Zend Framework Version 1.5.0 Update pl
Zend ≫ Zend Framework Version 1.5.0 Update pr
Zend ≫ Zend Framework Version 1.5.0 Update rc1
Zend ≫ Zend Framework Version 1.5.0 Update rc2
Zend ≫ Zend Framework Version 1.5.0 Update rc3
Zend ≫ Zend Framework Version 1.5.1
Zend ≫ Zend Framework Version 1.5.2
Zend ≫ Zend Framework Version 1.5.3
Zend ≫ Zend Framework Version 1.6.0
Zend ≫ Zend Framework Version 1.6.0 Update rc1
Zend ≫ Zend Framework Version 1.6.0 Update rc2
Zend ≫ Zend Framework Version 1.6.0 Update rc3
Zend ≫ Zend Framework Version 1.6.1
Zend ≫ Zend Framework Version 1.6.2
Zend ≫ Zend Framework Version 1.7.0
Zend ≫ Zend Framework Version 1.7.0 Update pl1
Zend ≫ Zend Framework Version 1.7.0 Update pr
Zend ≫ Zend Framework Version 1.7.1
Zend ≫ Zend Framework Version 1.7.2
Zend ≫ Zend Framework Version 1.7.3
Zend ≫ Zend Framework Version 1.7.3 Update pl1
Zend ≫ Zend Framework Version 1.7.4
Zend ≫ Zend Framework Version 1.7.5
Zend ≫ Zend Framework Version 1.7.6
Zend ≫ Zend Framework Version 1.7.7
Zend ≫ Zend Framework Version 1.7.8
Zend ≫ Zend Framework Version 1.7.9
Zend ≫ Zend Framework Version 1.8.0
Zend ≫ Zend Framework Version 1.8.0 Update a1
Zend ≫ Zend Framework Version 1.8.0 Update b1
Zend ≫ Zend Framework Version 1.8.1
Zend ≫ Zend Framework Version 1.8.2
Zend ≫ Zend Framework Version 1.8.3
Zend ≫ Zend Framework Version 1.8.4
Zend ≫ Zend Framework Version 1.8.4 Update pl1
Zend ≫ Zend Framework Version 1.8.5
Zend ≫ Zend Framework Version 1.9.0
Zend ≫ Zend Framework Version 1.9.0 Update a1
Zend ≫ Zend Framework Version 1.9.0 Update b1
Zend ≫ Zend Framework Version 1.9.0 Update rc1
Zend ≫ Zend Framework Version 1.9.1
Zend ≫ Zend Framework Version 1.9.2
Zend ≫ Zend Framework Version 1.9.3
Zend ≫ Zend Framework Version 1.9.3 Update pl1
Zend ≫ Zend Framework Version 1.9.4
Zend ≫ Zend Framework Version 1.9.5
Zend ≫ Zend Framework Version 1.9.6
Zend ≫ Zend Framework Version 1.9.7
Zend ≫ Zend Framework Version 1.9.8
Zend ≫ Zend Framework Version 1.10.0
Zend ≫ Zend Framework Version 1.10.0 Update alpha1
Zend ≫ Zend Framework Version 1.10.0 Update beta1
Zend ≫ Zend Framework Version 1.10.0 Update rc1
Zend ≫ Zend Framework Version 1.10.1
Zend ≫ Zend Framework Version 1.10.2
Zend ≫ Zend Framework Version 1.10.3
Zend ≫ Zend Framework Version 1.10.4
Zend ≫ Zend Framework Version 1.10.5
Zend ≫ Zend Framework Version 1.10.6
Zend ≫ Zend Framework Version 1.10.7
Zend ≫ Zend Framework Version 1.10.8
Zend ≫ Zend Framework Version 1.10.9
Zend ≫ Zend Framework Version 1.11.0
Zend ≫ Zend Framework Version 1.11.0 Update b1
Zend ≫ Zend Framework Version 1.11.0 Update rc1
Zend ≫ Zend Framework Version 1.11.1
Zend ≫ Zend Framework Version 1.11.2
Zend ≫ Zend Framework Version 1.11.3
Zend ≫ Zend Framework Version 1.11.4
Zend ≫ Zend Framework Version 1.11.5
Zend ≫ Zend Framework Version 1.11.6
Zend ≫ Zend Framework Version 1.11.7
Zend ≫ Zend Framework Version 1.11.8
Zend ≫ Zend Framework Version 1.11.9
Zend ≫ Zend Framework Version 1.11.10
Zend ≫ Zend Framework Version 1.11.11
Zend ≫ Zend Framework Version 1.11.12
Zend ≫ Zend Framework Version 1.11.13
Zend ≫ Zend Framework Version 1.12.0
Zend ≫ Zend Framework Version 1.12.0 Update rc1
Zend ≫ Zend Framework Version 1.12.0 Update rc2
Zend ≫ Zend Framework Version 1.12.0 Update rc3
Zend ≫ Zend Framework Version 1.12.0 Update rc4
Zend ≫ Zend Framework Version 1.12.1
Zend ≫ Zend Framework Version 1.12.2
Zend ≫ Zendopenid Version <= 2.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.8% 0.846
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

http://advisories.mageia.org/MGASA-2014-0151.html
http://framework.zend.com/security/advisory/ZF2014-02
Vendor Advisory
http://seclists.org/oss-sec/2014/q2/0
http://www.debian.org/security/2015/dsa-3265
http://www.mandriva.com/security/advisories?name=MDVSA-2014:072
http://www.securityfocus.com/bid/66358