Vulnerability Details : CVE-2014-2685
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
Vulnerability category: BypassGain privilege
Exploit prediction scoring system (EPSS) score for CVE-2014-2685
Probability of exploitation activity in the next 30 days: 1.56%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 87 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-2685
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2014-2685
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-2685
-
http://seclists.org/oss-sec/2014/q2/0
oss-sec: Re: CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02
-
http://www.mandriva.com/security/advisories?name=MDVSA-2014:072
mandriva.com
-
http://advisories.mageia.org/MGASA-2014-0151.html
Mageia Advisory: MGASA-2014-0151 - Updated php-ZendFramework packages fix multiple vulnerabilities
-
http://www.debian.org/security/2015/dsa-3265
Debian -- Security Information -- DSA-3265-1 zendframework
-
http://framework.zend.com/security/advisory/ZF2014-02
Security Advisory - Security - Zend FrameworkVendor Advisory
-
http://www.securityfocus.com/bid/66358
Zend Framework Multiple Information Disclosure and Security Bypass Vulnerabilities
Products affected by CVE-2014-2685
- cpe:2.3:a:zend:zend_framework:*:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.0.0:rc2a:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.0.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.0.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.5.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.5.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.6.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.6.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.8:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.9:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.8.4:pl1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.3:pl1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.0.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.5.0:pr:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.0:pr:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.0:pl1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.8:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.4:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.5:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.9:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.10:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.6:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.7:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.3:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.4:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.11:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.5.0:pl:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.0:b1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.6:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.7:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.7:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.8:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.5.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.6.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.3:pl1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.8.0:a1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.8.0:b1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.8.5:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.0:a1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.4:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.9.5:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.8:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.10.9:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.0:b1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.5:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.6:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.12.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.12.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.12.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.12.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.12:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.11.13:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zend_framework:1.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:zend:zendopenid:*:*:*:*:*:*:*:*