CVEvulnerability
CVE-2014-5376
4.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-10-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.0 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-20
Description
Adaptive Computing Moab before 7.2.9 and 8 before 8.0.0, when a pre-generated key is used, does not validate that the requesting user matches the actor in the message, which allows remote authenticated users to impersonate arbitrary users via the actor field in a message.
Affected configurations
• adaptivecomputing moab (<= 7.2.8)
• adaptivecomputing moab 8.0
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://packetstormsecurity.com/files/128485/Moab-Insecure-Message-Signing-Authentication-Bypass.html Exploit
- http://www.adaptivecomputing.com/security-advisory/ Vendor Advisory
- http://www.securityfocus.com/archive/1/533577/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/70171 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96700 exchange.xforce.ibmcloud.com
- http://packetstormsecurity.com/files/128485/Moab-Insecure-Message-Signing-Authentication-Bypass.html Exploit
- http://www.adaptivecomputing.com/security-advisory/ Vendor Advisory
- http://www.securityfocus.com/archive/1/533577/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/70171 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96700 exchange.xforce.ibmcloud.com