9.8

CVE-2014-8684

EPSS 71.52%
Veröffentlicht 19.09.2017 19:29:00
Zuletzt bearbeitet 13.05.2026 00:24:29
CVE-Watchlists
Login
Unerledigt
Login

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 7

NVD 4 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Codeigniter ≫ Codeigniter Version <= 2.2.6

Kohanaframework ≫ Kohana Version3.2.3

Kohanaframework ≫ Kohana Version3.3.0

Kohanaframework ≫ Kohana Version3.3.1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	71.52%	0.993

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html

Third Party Advisory

VDB Entry

http://seclists.org/fulldisclosure/2014/May/54

Third Party Advisory

Mailing List

https://github.com/kohana/core/pull/492

Third Party Advisory

https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2014-8684

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-8684

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-8684

EUVD