9.8

CVE-2014-8684

EPSS 44.85%
Veröffentlicht 19.09.2017 19:29:00
Zuletzt bearbeitet 20.04.2025 01:37:25
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 7

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Codeigniter ≫ Codeigniter Version <= 2.2.6

Kohanaframework ≫ Kohana Version3.2.3

Kohanaframework ≫ Kohana Version3.3.0

Kohanaframework ≫ Kohana Version3.3.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	44.85%	0.973

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	7.5	10	6.4	AV:N/AC:L/Au:N/C:P/I:P/A:P

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html

Third Party Advisory

VDB Entry

http://seclists.org/fulldisclosure/2014/May/54

Third Party Advisory

Mailing List

https://github.com/kohana/core/pull/492

Third Party Advisory

https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection

Third Party Advisory

https://nvd.nist.gov/vuln/detail/CVE-2014-8684

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-8684

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-8684

EUVD