CVE-2014-8684

EPSS 71.5%

Vexday Risk Score

60Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 71.5%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Ciclo de vida

01 mar 2015Exploit Metasploit disponible

04 mar 2015PoC pública

19 sep 2017Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 2

cve_referencepacketstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.htmlno verificado exploitdbwww.exploit-db.com/exploits/36264no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html http://seclists.org/fulldisclosure/2014/May/54 https://github.com/kohana/core/pull/492 https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection