CVE-2014-8684
critical · 9.8CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.
9.8
CVSS
71.7%
EPSS (exploit prob.)
99th
EPSS percentile
2017-09-19
Published
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-310
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| codeigniter | codeigniter | <= 2.2.6 |
| kohanaframework | kohana | 3.2.3 |
| kohanaframework | kohana | 3.3.0 |
| kohanaframework | kohana | 3.3.1 |
Check a specific version with /api/v1/cve/match.
References
- http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
- http://seclists.org/fulldisclosure/2014/May/54
- https://github.com/kohana/core/pull/492
- https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection
- http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
- http://seclists.org/fulldisclosure/2014/May/54
- https://github.com/kohana/core/pull/492
- https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2014-8684