CVE-2017-14143
CriticalSummary
The getUserzoneCookie function in Kaltura before version 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, allowing remote attackers to bypass an intended protection mechanism.
Risk Assessment
Attackers can conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzone cookie, posing a serious security threat to the application.
Recommendation
It is recommended to update Kaltura to version 13.2.0 or later to mitigate this vulnerability and avoid using hardcoded secrets in validation mechanisms.
Original NVD description (English source)
The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via a crafted userzone cookie.