PT-2020-7637 · Keplerproject+4 · Cgilua

Felipe Daragon · Published 2020-02-06 · Updated 2022-01-01 · CVE-2014-2875

NVD

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

The session.lua library in CGILua 5.2 alpha 1 and 5.2 alpha 2 uses weak session IDs generated based on OS time, which allows remote attackers to hijack arbitrary sessions via a brute force attack. NOTE: CVE-2014-10399 and CVE-2014-10400 were SPLIT from this ID.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2014-2875

Affected Products

Cgilua

References · 13

• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2875 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-2875 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/lua-cgi · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2875 · Security Note
• https://osv.dev/vulnerability/CVE-2014-2875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2875 · Security Note
• http://syhunt.com/en/index.php?n=Advisories.Cgilua-weaksessionid · Note
• http://securityfocus.com/archive/1/531981/100/0/threaded · Note
• https://t.me/cvenotify/840 · Telegram Post
• https://t.me/cvenotify/837 · Telegram Post
• https://packages.debian.org/src:lua-cgi · Note
• http://seclists.org/fulldisclosure/2014/Apr/318 · Note
• https://t.me/cvenotify/836 · Telegram Post