PT-2020-7637 · Keplerproject+4 · Cgilua

Felipe Daragon · Publicado 2020-02-06 · Atualizado 2022-01-01 · CVE-2014-2875

NVD

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID.

Correção

Improper Restriction of Excessive Authentication Attempts

Enumeração de Fraquezas

CWE-307

Identificadores relacionados

CVE-2014-2875

Produtos afetados

Cgilua

Referências · 13

• http://syhunt.com/en/index.php?n=Advisories.Cgilua-weaksessionid · Nota
• http://securityfocus.com/archive/1/531981/100/0/threaded · Nota
• https://t.me/cvenotify/840 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2875 · Aviso do Fabricante
• https://t.me/cvenotify/837 · Publicação no Telegram
• https://packages.debian.org/src:lua-cgi · Nota
• https://security-tracker.debian.org/tracker/CVE-2014-2875 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/source-package/lua-cgi · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2875 · Nota de Segurança
• http://seclists.org/fulldisclosure/2014/Apr/318 · Nota
• https://t.me/cvenotify/836 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2014-2875 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-2875 · Nota de Segurança