CVE-2014-8684

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-09-19

Last modified

2024-08-06

Weaknesses

CWE-310

Affected products

• Codeigniter (Codeigniter)
• Kohana (Kohanaframework)

References

• http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
• http://seclists.org/fulldisclosure/2014/May/54
• https://github.com/kohana/core/pull/492
• https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection