CVE Catalog
CVE-2014-8686
CriticalSummary
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.
Risk Assessment
The lack of proper encryption for session cookies may lead to the exposure of sensitive user data, creating a risk of session hijacking.
Recommendation
It is recommended to upgrade CodeIgniter to version 2.2.0 or later to eliminate this vulnerability.
Original NVD description (English source)
CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.