CVEvulnerability
CVE-2014-8684
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-09-19
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-310
Description
CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.
Affected configurations
• codeigniter codeigniter (<= 2.2.6)
• kohanaframework kohana 3.2.3
• kohanaframework kohana 3.3.0
• kohanaframework kohana 3.3.1
Related
Weakness · not in database (1)
References
- http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2014/May/54 Mailing List, Third Party Advisory
- https://github.com/kohana/core/pull/492 Third Party Advisory
- https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection Third Party Advisory
- http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2014/May/54 Mailing List, Third Party Advisory
- https://github.com/kohana/core/pull/492 Third Party Advisory
- https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection Third Party Advisory