CVE-2014-8684

Critical

Published: 19/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 allow remote attackers to spoof session cookies, potentially leading to PHP object injection attacks. This issue arises from the use of standard string comparison operators to compare cryptographic hashes.

Risk Assessment

Organizations may be vulnerable to attacks that allow session hijacking and unauthorized code execution. This could lead to data breaches or system compromises.

Recommendation

It is recommended to upgrade to the latest version of CodeIgniter or Kohana to mitigate this vulnerability. Additionally, consider implementing extra security measures for user sessions.

Original NVD description (English source)

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.