CVE-2014-8684

EPSS 71.5%

Vexday Risk Score

60Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 71.5%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

01 Mar 2015Metasploit module available

04 Mar 2015Public PoC

19 Sep 2017Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/36264unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html http://seclists.org/fulldisclosure/2014/May/54 https://github.com/kohana/core/pull/492 https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection