Packagist/codeigniter/framework CVE-2014-8684: critical 9.8, EPSS 72.16%
CodeIgniter and Kohana vulnerable to PHP Object Injection
Action: Upgrade codeigniter/framework to 3.0.0 or later.
composer require codeigniter/framework:3.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.0.0 | - |
Fixed versions
| 3.0.0 |
Sources
- osv: GHSA-w9ph-q4h9-rwq6
- https://nvd.nist.gov/vuln/detail/CVE-2014-8684
- https://github.com/kohana/core/pull/492
- https://github.com/kohana/core/commit/66b409a6da2960130888989534ff1799532b8f32
- https://github.com/bcit-ci/CodeIgniter/blob/2.2.6/system/libraries/Session.php#L159
- https://web.archive.org/web/20140802041151/https://scott.arciszewski.me/research/full/php-framework-timing-attacks-object-injection
- http://packetstormsecurity.com/files/130609/Seagate-Business-NAS-Unauthenticated-Remote-Command-Execution.html
- http://seclists.org/fulldisclosure/2014/May/54
CVE-2014-8684 · published · modified · JSON